Merge branch '0.9.x' into 1.0.x

Conflicts:
	classes/statusnet.ini
	db/statusnet.sql
	lib/jabber.php
	lib/xmppmanager.php

86 files changed, 8445 insertions, 4240 deletions

diff --git a/plugins/Blacklist/BlacklistPlugin.php b/plugins/Blacklist/BlacklistPlugin.php
index 84a2cb616..fb8f7306f 100644
--- a/plugins/Blacklist/BlacklistPlugin.php
+++ b/plugins/Blacklist/BlacklistPlugin.php
@@ -22,7 +22,7 @@
  * @category  Action
  * @package   StatusNet
  * @author    Evan Prodromou <evan@status.net>
- * @copyright 2009 StatusNet Inc.
+ * @copyright 2010 StatusNet Inc.
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  * @link      http://status.net/
  */
@@ -47,6 +47,55 @@ class BlacklistPlugin extends Plugin
 
     public $nicknames = array();
     public $urls      = array();
+    public $canAdmin  = true;
+
+    private $_nicknamePatterns = array();
+    private $_urlPatterns      = array();
+
+    /**
+     * Initialize the plugin
+     *
+     * @return void
+     */
+
+    function initialize()
+    {
+        $confNicknames = $this->_configArray('blacklist', 'nicknames');
+
+        $this->_nicknamePatterns = array_merge($this->nicknames,
+                                               $confNicknames);
+
+        $confURLs = $this->_configArray('blacklist', 'urls');
+
+        $this->_urlPatterns = array_merge($this->urls,
+                                          $confURLs);
+    }
+
+    /**
+     * Retrieve an array from configuration
+     *
+     * Carefully checks a section.
+     *
+     * @param string $section Configuration section
+     * @param string $setting Configuration setting
+     *
+     * @return array configuration values
+     */
+
+    function _configArray($section, $setting)
+    {
+        $config = common_config($section, $setting);
+
+        if (empty($config)) {
+            return array();
+        } else if (is_array($config)) {
+            return $config;
+        } else if (is_string($config)) {
+            return explode("\r\n", $config);
+        } else {
+            throw new Exception("Unknown data type for config $section + $setting");
+        }
+    }
 
     /**
      * Hook registration to prevent blacklisted homepages or nicknames
@@ -173,7 +222,8 @@ class BlacklistPlugin extends Plugin
 
     private function _checkUrl($url)
     {
-        foreach ($this->urls as $pattern) {
+        foreach ($this->_urlPatterns as $pattern) {
+            common_debug("Checking $url against $pattern");
             if (preg_match("/$pattern/", $url)) {
                 return false;
             }
@@ -194,7 +244,8 @@ class BlacklistPlugin extends Plugin
 
     private function _checkNickname($nickname)
     {
-        foreach ($this->nicknames as $pattern) {
+        foreach ($this->_nicknamePatterns as $pattern) {
+            common_debug("Checking $nickname against $pattern");
             if (preg_match("/$pattern/", $nickname)) {
                 return false;
             }
@@ -203,14 +254,191 @@ class BlacklistPlugin extends Plugin
         return true;
     }
 
+    /**
+     * Add our actions to the URL router
+     *
+     * @param Net_URL_Mapper $m URL mapper for this hit
+     *
+     * @return boolean hook return
+     */
+
+    function onRouterInitialized($m)
+    {
+        $m->connect('admin/blacklist', array('action' => 'blacklistadminpanel'));
+        return true;
+    }
+
+    /**
+     * Auto-load our classes if called
+     *
+     * @param string $cls Class to load
+     *
+     * @return boolean hook return
+     */
+
+    function onAutoload($cls)
+    {
+        switch (strtolower($cls))
+        {
+        case 'blacklistadminpanelaction':
+            $base = strtolower(mb_substr($cls, 0, -6));
+            include_once INSTALLDIR.'/plugins/Blacklist/'.$base.'.php';
+            return false;
+        default:
+            return true;
+        }
+    }
+
+    /**
+     * Plugin version data
+     *
+     * @param array &$versions array of version blocks
+     *
+     * @return boolean hook value
+     */
+
     function onPluginVersion(&$versions)
     {
         $versions[] = array('name' => 'Blacklist',
                             'version' => self::VERSION,
                             'author' => 'Evan Prodromou',
-                            'homepage' => 'http://status.net/wiki/Plugin:Blacklist',
+                            'homepage' =>
+                            'http://status.net/wiki/Plugin:Blacklist',
                             'description' =>
-                            _m('Keep a blacklist of forbidden nickname and URL patterns.'));
+                            _m('Keep a blacklist of forbidden nickname '.
+                               'and URL patterns.'));
+        return true;
+    }
+
+    /**
+     * Determines if our admin panel can be shown
+     *
+     * @param string  $name  name of the admin panel
+     * @param boolean &$isOK result
+     *
+     * @return boolean hook value
+     */
+
+    function onAdminPanelCheck($name, &$isOK)
+    {
+        if ($name == 'blacklist') {
+            $isOK = $this->canAdmin;
+            return false;
+        }
+
         return true;
     }
+
+    /**
+     * Add our tab to the admin panel
+     *
+     * @param Widget $nav Admin panel nav
+     *
+     * @return boolean hook value
+     */
+
+    function onEndAdminPanelNav($nav)
+    {
+        if (AdminPanelAction::canAdmin('blacklist')) {
+
+            $action_name = $nav->action->trimmed('action');
+
+            $nav->out->menuItem(common_local_url('blacklistadminpanel'),
+                                _('Blacklist'),
+                                _('Blacklist configuration'),
+                                $action_name == 'blacklistadminpanel',
+                                'nav_blacklist_admin_panel');
+        }
+
+        return true;
+    }
+
+    function onEndDeleteUserForm($action, $user)
+    {
+        $cur = common_current_user();
+
+        if (empty($cur) || !$cur->hasRight(Right::CONFIGURESITE)) {
+            return;
+        }
+
+        $profile = $user->getProfile();
+
+        if (empty($profile)) {
+            return;
+        }
+
+        $action->elementStart('ul', 'form_data');
+        $action->elementStart('li');
+        $this->checkboxAndText($action,
+                               'blacklistnickname',
+                               _('Add this nickname pattern to blacklist'),
+                               'blacklistnicknamepattern',
+                               $this->patternizeNickname($user->nickname));
+        $action->elementEnd('li');
+
+        if (!empty($profile->homepage)) {
+            $action->elementStart('li');
+            $this->checkboxAndText($action,
+                                   'blacklisthomepage',
+                                   _('Add this homepage pattern to blacklist'),
+                                   'blacklisthomepagepattern',
+                                   $this->patternizeHomepage($profile->homepage));
+            $action->elementEnd('li');
+        }
+
+        $action->elementEnd('ul');
+    }
+
+    function onEndDeleteUser($action, $user)
+    {
+        common_debug("Action args: " . print_r($action->args, true));
+
+        if ($action->boolean('blacklisthomepage')) {
+            $pattern = $action->trimmed('blacklisthomepagepattern');
+            $confURLs = $this->_configArray('blacklist', 'urls');
+            $confURLs[] = $pattern;
+            Config::save('blacklist', 'urls', implode("\r\n", $confURLs));
+        }
+
+        if ($action->boolean('blacklistnickname')) {
+            $pattern = $action->trimmed('blacklistnicknamepattern');
+            $confNicknames = $this->_configArray('blacklist', 'nicknames');
+            $confNicknames[] = $pattern;
+            Config::save('blacklist', 'nicknames', implode("\r\n", $confNicknames));
+        }
+
+        return true;
+    }
+
+    function checkboxAndText($action, $checkID, $label, $textID, $value)
+    {
+        $action->element('input', array('name' => $checkID,
+                                        'type' => 'checkbox',
+                                        'class' => 'checkbox',
+                                        'id' => $checkID));
+
+        $action->text(' ');
+
+        $action->element('label', array('class' => 'checkbox',
+                                        'for' => $checkID),
+                         $label);
+
+        $action->text(' ');
+
+        $action->element('input', array('name' => $textID,
+                                        'type' => 'text',
+                                        'id' => $textID,
+                                        'value' => $value));
+    }
+
+    function patternizeNickname($nickname)
+    {
+        return $nickname;
+    }
+
+    function patternizeHomepage($homepage)
+    {
+        $hostname = parse_url($homepage, PHP_URL_HOST);
+        return $hostname;
+    }
 }
diff --git a/plugins/Blacklist/blacklistadminpanel.php b/plugins/Blacklist/blacklistadminpanel.php
new file mode 100644
index 000000000..98d07080d
--- /dev/null
+++ b/plugins/Blacklist/blacklistadminpanel.php
@@ -0,0 +1,222 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Blacklist administration panel
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Settings
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPLv3
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * Administer blacklist
+ *
+ * @category Admin
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class BlacklistadminpanelAction extends AdminPanelAction
+{
+    /**
+     * title of the admin panel
+     *
+     * @return string title
+     */
+
+    function title()
+    {
+        return _('Blacklist');
+    }
+
+    /**
+     * Panel instructions
+     *
+     * @return string instructions
+     */
+
+    function getInstructions()
+    {
+        return _('Blacklisted URLs and nicknames');
+    }
+
+    /**
+     * Show the actual form
+     *
+     * @return void
+     *
+     * @see BlacklistAdminPanelForm
+     */
+
+    function showForm()
+    {
+        $form = new BlacklistAdminPanelForm($this);
+        $form->show();
+        return;
+    }
+
+    /**
+     * Save the form settings
+     *
+     * @return void
+     */
+
+    function saveSettings()
+    {
+        static $settings = array(
+                'blacklist' => array('nicknames', 'urls'),
+        );
+
+        $values = array();
+
+        foreach ($settings as $section => $parts) {
+            foreach ($parts as $setting) {
+                $values[$section][$setting] = $this->trimmed("$section-$setting");
+            }
+        }
+
+        // This throws an exception on validation errors
+
+        $this->validate($values);
+
+        // assert(all values are valid);
+
+        $config = new Config();
+
+        $config->query('BEGIN');
+
+        foreach ($settings as $section => $parts) {
+            foreach ($parts as $setting) {
+                Config::save($section, $setting, $values[$section][$setting]);
+            }
+        }
+
+        $config->query('COMMIT');
+
+        return;
+    }
+
+    /**
+     * Validate the values
+     *
+     * @param array &$values 2d array of values to check
+     *
+     * @return boolean success flag
+     */
+
+    function validate(&$values)
+    {
+        return true;
+    }
+}
+
+/**
+ * Admin panel form for blacklist panel
+ *
+ * @category Admin
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class BlacklistAdminPanelForm extends Form
+{
+    /**
+     * ID of the form
+     *
+     * @return string ID
+     */
+
+    function id()
+    {
+        return 'blacklistadminpanel';
+    }
+
+    /**
+     * Class of the form
+     *
+     * @return string class
+     */
+
+    function formClass()
+    {
+        return 'form_settings';
+    }
+
+    /**
+     * Action we post to
+     *
+     * @return string action URL
+     */
+
+    function action()
+    {
+        return common_local_url('blacklistadminpanel');
+    }
+
+    /**
+     * Show the form controls
+     *
+     * @return void
+     */
+
+    function formData()
+    {
+        $this->out->elementStart('ul', 'form_data');
+
+        $this->out->elementStart('li');
+        $this->out->textarea('blacklist-nicknames', _m('Nicknames'),
+                             common_config('blacklist', 'nicknames'),
+                             _('Patterns of nicknames to block, one per line'));
+        $this->out->elementEnd('li');
+
+        $this->out->elementStart('li');
+        $this->out->textarea('blacklist-urls', _m('URLs'),
+                             common_config('blacklist', 'urls'),
+                             _('Patterns of URLs to block, one per line'));
+        $this->out->elementEnd('li');
+
+        $this->out->elementEnd('ul');
+    }
+
+    /**
+     * Buttons for submitting
+     *
+     * @return void
+     */
+
+    function formActions()
+    {
+        $this->out->submit('submit',
+                           _('Save'),
+                           'submit',
+                           null,
+                           _('Save site settings'));
+    }
+}
diff --git a/plugins/BlogspamNetPlugin.php b/plugins/BlogspamNetPlugin.php
index 51236001a..d52e6006a 100644
--- a/plugins/BlogspamNetPlugin.php
+++ b/plugins/BlogspamNetPlugin.php
@@ -72,8 +72,10 @@ class BlogspamNetPlugin extends Plugin
         common_debug("Blogspamnet args = " . print_r($args, TRUE));
         $requestBody = xmlrpc_encode_request('testComment', array($args));
 
-        $request = HTTPClient::start();
-        $httpResponse = $request->post($this->baseUrl, array('Content-Type: text/xml'), $requestBody);
+        $request = new HTTPClient($this->baseUrl, HTTPClient::METHOD_POST);
+        $request->setHeader('Content-Type', 'text/xml');
+        $request->setBody($requestBody);
+        $httpResponse = $request->send();
 
         $response = xmlrpc_decode($httpResponse->getBody());
         if (xmlrpc_is_fault($response)) {
@@ -118,7 +120,7 @@ class BlogspamNetPlugin extends Plugin
         $args['site'] = common_root_url();
         $args['version'] = $this->userAgent();
 
-        $args['options'] = "max-size=140,min-size=0,min-words=0,exclude=bayasian";
+        $args['options'] = "max-size=" . common_config('site','textlimit') . ",min-size=0,min-words=0,exclude=bayasian";
 
         return $args;
     }
diff --git a/plugins/CasAuthentication/CasAuthenticationPlugin.php b/plugins/CasAuthentication/CasAuthenticationPlugin.php
index 483b060ab..203e5fe42 100644
--- a/plugins/CasAuthentication/CasAuthenticationPlugin.php
+++ b/plugins/CasAuthentication/CasAuthenticationPlugin.php
@@ -137,6 +137,7 @@ class CasAuthenticationPlugin extends AuthenticationPlugin
         $casSettings['server']=$this->server;
         $casSettings['port']=$this->port;
         $casSettings['path']=$this->path;
+        $casSettings['takeOverLogin']=$this->takeOverLogin;
     }
 
     function onPluginVersion(&$versions)
diff --git a/plugins/CasAuthentication/caslogin.php b/plugins/CasAuthentication/caslogin.php
index 390a75d8b..a66774dc1 100644
--- a/plugins/CasAuthentication/caslogin.php
+++ b/plugins/CasAuthentication/caslogin.php
@@ -54,9 +54,18 @@ class CasloginAction extends Action
                 // We don't have to return to it again
                 common_set_returnto(null);
             } else {
-                $url = common_local_url('all',
-                                    array('nickname' =>
-                                          $user->nickname));
+                if(common_config('site', 'private') && $casSettings['takeOverLogin']) {
+                    //SSO users expect to just go to the URL they entered
+                    //if we don't have a returnto set, the user entered the
+                    //main StatusNet url, so send them there.
+                    $url = common_local_url('public');
+                } else {
+                    //With normal logins (regular form-based username/password),
+                    //the user would expect to go to their home after logging in.
+                    $url = common_local_url('public',
+                                        array('nickname' =>
+                                              $user->nickname));
+                }
             }
 
             common_redirect($url, 303);
diff --git a/plugins/CasAuthentication/extlib/CAS.php b/plugins/CasAuthentication/extlib/CAS.php
index f5ea0b12a..e75437419 100644
--- a/plugins/CasAuthentication/extlib/CAS.php
+++ b/plugins/CasAuthentication/extlib/CAS.php
@@ -1,1471 +1,1615 @@
-<?php
-
-// commented in 0.4.22-RC2 for Sylvain Derosiaux
-// error_reporting(E_ALL ^ E_NOTICE);
-
-//
-// hack by Vangelis Haniotakis to handle the absence of $_SERVER['REQUEST_URI'] in IIS
-//
-if (!$_SERVER['REQUEST_URI']) {
-	$_SERVER['REQUEST_URI'] = $_SERVER['SCRIPT_NAME'].'?'.$_SERVER['QUERY_STRING'];
-}
-
-//
-// another one by Vangelis Haniotakis also to make phpCAS work with PHP5
-//
-if (version_compare(PHP_VERSION,'5','>=')) {
-	require_once(dirname(__FILE__).'/CAS/domxml-php4-php5.php');
-}
-
-/**
- * @file CAS/CAS.php
- * Interface class of the phpCAS library
- *
- * @ingroup public
- */
-
-// ########################################################################
-//  CONSTANTS
-// ########################################################################
-
-// ------------------------------------------------------------------------
-//  CAS VERSIONS
-// ------------------------------------------------------------------------
-
-/**
- * phpCAS version. accessible for the user by phpCAS::getVersion().
- */
-define('PHPCAS_VERSION','1.0.1');
-
-// ------------------------------------------------------------------------
-//  CAS VERSIONS
-// ------------------------------------------------------------------------
- /**
-  * @addtogroup public
-  * @{
-  */
-
-/**
- * CAS version 1.0
- */
-define("CAS_VERSION_1_0",'1.0');
-/*!
- * CAS version 2.0
- */
-define("CAS_VERSION_2_0",'2.0');
-
-/** @} */
- /**
-  * @addtogroup publicPGTStorage
-  * @{
-  */
-// ------------------------------------------------------------------------
-//  FILE PGT STORAGE
-// ------------------------------------------------------------------------
- /**
-  * Default path used when storing PGT's to file
-  */
-define("CAS_PGT_STORAGE_FILE_DEFAULT_PATH",'/tmp');
-/**
- * phpCAS::setPGTStorageFile()'s 2nd parameter to write plain text files
- */
-define("CAS_PGT_STORAGE_FILE_FORMAT_PLAIN",'plain');
-/**
- * phpCAS::setPGTStorageFile()'s 2nd parameter to write xml files
- */
-define("CAS_PGT_STORAGE_FILE_FORMAT_XML",'xml');
-/**
- * Default format used when storing PGT's to file
- */
-define("CAS_PGT_STORAGE_FILE_DEFAULT_FORMAT",CAS_PGT_STORAGE_FILE_FORMAT_PLAIN);
-// ------------------------------------------------------------------------
-//  DATABASE PGT STORAGE
-// ------------------------------------------------------------------------
- /**
-  * default database type when storing PGT's to database
-  */
-define("CAS_PGT_STORAGE_DB_DEFAULT_DATABASE_TYPE",'mysql');
-/**
- * default host when storing PGT's to database
- */
-define("CAS_PGT_STORAGE_DB_DEFAULT_HOSTNAME",'localhost');
-/**
- * default port when storing PGT's to database
- */
-define("CAS_PGT_STORAGE_DB_DEFAULT_PORT",'');
-/**
- * default database when storing PGT's to database
- */
-define("CAS_PGT_STORAGE_DB_DEFAULT_DATABASE",'phpCAS');
-/**
- * default table when storing PGT's to database
- */
-define("CAS_PGT_STORAGE_DB_DEFAULT_TABLE",'pgt');
-
-/** @} */
-// ------------------------------------------------------------------------
-// SERVICE ACCESS ERRORS
-// ------------------------------------------------------------------------
- /**
-  * @addtogroup publicServices
-  * @{
-  */
-
-/**
- * phpCAS::service() error code on success
- */
-define("PHPCAS_SERVICE_OK",0);
-/**
- * phpCAS::service() error code when the PT could not retrieve because
- * the CAS server did not respond.
- */
-define("PHPCAS_SERVICE_PT_NO_SERVER_RESPONSE",1);
-/**
- * phpCAS::service() error code when the PT could not retrieve because
- * the response of the CAS server was ill-formed.
- */
-define("PHPCAS_SERVICE_PT_BAD_SERVER_RESPONSE",2);
-/**
- * phpCAS::service() error code when the PT could not retrieve because
- * the CAS server did not want to.
- */
-define("PHPCAS_SERVICE_PT_FAILURE",3);
-/**
- * phpCAS::service() error code when the service was not available.
- */
-define("PHPCAS_SERVICE_NOT AVAILABLE",4);
-
-/** @} */
-// ------------------------------------------------------------------------
-//  LANGUAGES
-// ------------------------------------------------------------------------
- /**
-  * @addtogroup publicLang
-  * @{
-  */
-
-define("PHPCAS_LANG_ENGLISH",    'english');
-define("PHPCAS_LANG_FRENCH",     'french');
-define("PHPCAS_LANG_GREEK",      'greek');
-define("PHPCAS_LANG_GERMAN",     'german');
-define("PHPCAS_LANG_JAPANESE",   'japanese');
-define("PHPCAS_LANG_SPANISH",    'spanish');
-define("PHPCAS_LANG_CATALAN",    'catalan');
-
-/** @} */
-
-/**
- * @addtogroup internalLang
- * @{
- */
-
-/**
- * phpCAS default language (when phpCAS::setLang() is not used)
- */
-define("PHPCAS_LANG_DEFAULT", PHPCAS_LANG_ENGLISH);
-
-/** @} */
-// ------------------------------------------------------------------------
-//  DEBUG
-// ------------------------------------------------------------------------
- /**
-  * @addtogroup publicDebug
-  * @{
-  */
-
-/**
- * The default directory for the debug file under Unix.
- */
-define('DEFAULT_DEBUG_DIR','/tmp/');
-
-/** @} */
-// ------------------------------------------------------------------------
-//  MISC
-// ------------------------------------------------------------------------
- /**
-  * @addtogroup internalMisc
-  * @{
-  */
-
-/**
- * This global variable is used by the interface class phpCAS.
- *
- * @hideinitializer
- */
-$GLOBALS['PHPCAS_CLIENT']  = null;
-
-/**
- * This global variable is used to store where the initializer is called from 
- * (to print a comprehensive error in case of multiple calls).
- *
- * @hideinitializer
- */
-$GLOBALS['PHPCAS_INIT_CALL'] = array('done' => FALSE,
-	'file' => '?',
-	'line' => -1,
-	'method' => '?');
-
-/**
- * This global variable is used to store where the method checking
- * the authentication is called from (to print comprehensive errors)
- *
- * @hideinitializer
- */
-$GLOBALS['PHPCAS_AUTH_CHECK_CALL'] = array('done' => FALSE,
-	'file' => '?',
-	'line' => -1,
-	'method' => '?',
-	'result' => FALSE);
-
-/**
- * This global variable is used to store phpCAS debug mode.
- *
- * @hideinitializer
- */
-$GLOBALS['PHPCAS_DEBUG']  = array('filename' => FALSE,
-	'indent' => 0,
-	'unique_id' => '');
-
-/** @} */
-
-// ########################################################################
-//  CLIENT CLASS
-// ########################################################################
-
-// include client class
-include_once(dirname(__FILE__).'/CAS/client.php');
-
-// ########################################################################
-//  INTERFACE CLASS
-// ########################################################################
-
-/**
- * @class phpCAS
- * The phpCAS class is a simple container for the phpCAS library. It provides CAS
- * authentication for web applications written in PHP.
- *
- * @ingroup public
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- *
- * \internal All its methods access the same object ($PHPCAS_CLIENT, declared 
- * at the end of CAS/client.php).
- */
-
-
-
-class phpCAS
-{
-	
-	// ########################################################################
-	//  INITIALIZATION
-	// ########################################################################
-	
-	/**
-	 * @addtogroup publicInit
-	 * @{
-	 */
-	
-	/**
-	 * phpCAS client initializer.
-	 * @note Only one of the phpCAS::client() and phpCAS::proxy functions should be
-	 * called, only once, and before all other methods (except phpCAS::getVersion()
-	 * and phpCAS::setDebug()).
-	 *
-	 * @param $server_version the version of the CAS server
-	 * @param $server_hostname the hostname of the CAS server
-	 * @param $server_port the port the CAS server is running on
-	 * @param $server_uri the URI the CAS server is responding on
-	 * @param $start_session Have phpCAS start PHP sessions (default true)
-	 *
-	 * @return a newly created CASClient object
-	 */
-	function client($server_version,
-					$server_hostname,
-					$server_port,
-					$server_uri,
-					$start_session = true)
-		{
-		global $PHPCAS_CLIENT, $PHPCAS_INIT_CALL;
-		
-		phpCAS::traceBegin();
-		if ( is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error($PHPCAS_INIT_CALL['method'].'() has already been called (at '.$PHPCAS_INIT_CALL['file'].':'.$PHPCAS_INIT_CALL['line'].')');
-		}
-		if ( gettype($server_version) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $server_version (should be `string\')');
-		}
-		if ( gettype($server_hostname) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $server_hostname (should be `string\')');
-		}
-		if ( gettype($server_port) != 'integer' ) {
-			phpCAS::error('type mismatched for parameter $server_port (should be `integer\')');
-		}
-		if ( gettype($server_uri) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $server_uri (should be `string\')');
-		}
-		
-		// store where the initialzer is called from
-		$dbg = phpCAS::backtrace();
-		$PHPCAS_INIT_CALL = array('done' => TRUE,
-			'file' => $dbg[0]['file'],
-			'line' => $dbg[0]['line'],
-			'method' => __CLASS__.'::'.__FUNCTION__);
-		
-		// initialize the global object $PHPCAS_CLIENT
-		$PHPCAS_CLIENT = new CASClient($server_version,FALSE/*proxy*/,$server_hostname,$server_port,$server_uri,$start_session);
-		phpCAS::traceEnd();
-		}
-	
-	/**
-	 * phpCAS proxy initializer.
-	 * @note Only one of the phpCAS::client() and phpCAS::proxy functions should be
-	 * called, only once, and before all other methods (except phpCAS::getVersion()
-	 * and phpCAS::setDebug()).
-	 *
-	 * @param $server_version the version of the CAS server
-	 * @param $server_hostname the hostname of the CAS server
-	 * @param $server_port the port the CAS server is running on
-	 * @param $server_uri the URI the CAS server is responding on
-	 * @param $start_session Have phpCAS start PHP sessions (default true)
-	 *
-	 * @return a newly created CASClient object
-	 */
-	function proxy($server_version,
-				   $server_hostname,
-				   $server_port,
-				   $server_uri,
-				   $start_session = true)
-		{
-		global $PHPCAS_CLIENT, $PHPCAS_INIT_CALL;
-		
-		phpCAS::traceBegin();
-		if ( is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error($PHPCAS_INIT_CALL['method'].'() has already been called (at '.$PHPCAS_INIT_CALL['file'].':'.$PHPCAS_INIT_CALL['line'].')');
-		}
-		if ( gettype($server_version) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $server_version (should be `string\')');
-		}
-		if ( gettype($server_hostname) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $server_hostname (should be `string\')');
-		}
-		if ( gettype($server_port) != 'integer' ) {
-			phpCAS::error('type mismatched for parameter $server_port (should be `integer\')');
-		}
-		if ( gettype($server_uri) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $server_uri (should be `string\')');
-		}
-		
-		// store where the initialzer is called from
-		$dbg = phpCAS::backtrace();
-		$PHPCAS_INIT_CALL = array('done' => TRUE,
-			'file' => $dbg[0]['file'],
-			'line' => $dbg[0]['line'],
-			'method' => __CLASS__.'::'.__FUNCTION__);
-		
-		// initialize the global object $PHPCAS_CLIENT
-		$PHPCAS_CLIENT = new CASClient($server_version,TRUE/*proxy*/,$server_hostname,$server_port,$server_uri,$start_session);
-		phpCAS::traceEnd();
-		}
-	
-	/** @} */
-	// ########################################################################
-	//  DEBUGGING
-	// ########################################################################
-	
-	/**
-	 * @addtogroup publicDebug
-	 * @{
-	 */
-	
-	/**
-	 * Set/unset debug mode
-	 *
-	 * @param $filename the name of the file used for logging, or FALSE to stop debugging.
-	 */
-	function setDebug($filename='')
-		{
-		global $PHPCAS_DEBUG;
-		
-		if ( $filename != FALSE && gettype($filename) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $dbg (should be FALSE or the name of the log file)');
-		}
-		
-		if ( empty($filename) ) {
-			if ( preg_match('/^Win.*/',getenv('OS')) ) {
-				if ( isset($_ENV['TMP']) ) {
-					$debugDir = $_ENV['TMP'].'/';
-				} else if ( isset($_ENV['TEMP']) ) {
-					$debugDir = $_ENV['TEMP'].'/';
-				} else {
-					$debugDir = '';
-				}
-			} else {
-				$debugDir = DEFAULT_DEBUG_DIR;
-			}
-			$filename = $debugDir . 'phpCAS.log';
-		}
-		
-		if ( empty($PHPCAS_DEBUG['unique_id']) ) {
-			$PHPCAS_DEBUG['unique_id'] = substr(strtoupper(md5(uniqid(''))),0,4);
-		}
-		
-		$PHPCAS_DEBUG['filename'] = $filename;
-		
-		phpCAS::trace('START ******************');
-		}
-	
-	/** @} */
-	/**
-	 * @addtogroup internalDebug
-	 * @{
-	 */
-	
-	/**
-	 * This method is a wrapper for debug_backtrace() that is not available 
-	 * in all PHP versions (>= 4.3.0 only)
-	 */
-	function backtrace()
-		{
-		if ( function_exists('debug_backtrace') ) {
-			return debug_backtrace();
-		} else {
-			// poor man's hack ... but it does work ...
-			return array();
-		}
-		}
-	
-	/**
-	 * Logs a string in debug mode.
-	 *
-	 * @param $str the string to write
-	 *
-	 * @private
-	 */
-	function log($str)
-		{
-		$indent_str = ".";
-		global $PHPCAS_DEBUG;
-		
-		if ( $PHPCAS_DEBUG['filename'] ) {
-			for ($i=0;$i<$PHPCAS_DEBUG['indent'];$i++) {
-				$indent_str .= '|    ';
-			}
-			error_log($PHPCAS_DEBUG['unique_id'].' '.$indent_str.$str."\n",3,$PHPCAS_DEBUG['filename']);
-		}
-		
-		}
-	
-	/**
-	 * This method is used by interface methods to print an error and where the function
-	 * was originally called from.
-	 *
-	 * @param $msg the message to print
-	 *
-	 * @private
-	 */
-	function error($msg)
-		{
-		$dbg = phpCAS::backtrace();
-		$function = '?';
-		$file = '?';
-		$line = '?';
-		if ( is_array($dbg) ) {
-			for ( $i=1; $i<sizeof($dbg); $i++) {
-				if ( is_array($dbg[$i]) ) {
-					if ( $dbg[$i]['class'] == __CLASS__ ) {
-						$function = $dbg[$i]['function'];
-						$file = $dbg[$i]['file'];
-						$line = $dbg[$i]['line'];
-					}
-				}
-			}
-		}
-		echo "<br />\n<b>phpCAS error</b>: <font color=\"FF0000\"><b>".__CLASS__."::".$function.'(): '.htmlentities($msg)."</b></font> in <b>".$file."</b> on line <b>".$line."</b><br />\n";
-		phpCAS::trace($msg);
-		phpCAS::traceExit();
-		exit();
-		}
-	
-	/**
-	 * This method is used to log something in debug mode.
-	 */
-	function trace($str)
-		{
-		$dbg = phpCAS::backtrace();
-		phpCAS::log($str.' ['.basename($dbg[1]['file']).':'.$dbg[1]['line'].']');
-		}
-	
-	/**
-	 * This method is used to indicate the start of the execution of a function in debug mode.
-	 */
-	function traceBegin()
-		{
-		global $PHPCAS_DEBUG;
-		
-		$dbg = phpCAS::backtrace();
-		$str = '=> ';
-		if ( !empty($dbg[2]['class']) ) {
-			$str .= $dbg[2]['class'].'::';
-		}
-		$str .= $dbg[2]['function'].'(';      
-		if ( is_array($dbg[2]['args']) ) {
-			foreach ($dbg[2]['args'] as $index => $arg) {
-				if ( $index != 0 ) {
-					$str .= ', ';
-				}
-				$str .= str_replace("\n","",var_export($arg,TRUE));
-			}
-		}
-		$str .= ') ['.basename($dbg[2]['file']).':'.$dbg[2]['line'].']';
-		phpCAS::log($str);
-		$PHPCAS_DEBUG['indent'] ++;
-		}
-	
-	/**
-	 * This method is used to indicate the end of the execution of a function in debug mode.
-	 *
-	 * @param $res the result of the function
-	 */
-	function traceEnd($res='')
-		{
-		global $PHPCAS_DEBUG;
-		
-		$PHPCAS_DEBUG['indent'] --;
-		$dbg = phpCAS::backtrace();
-		$str = '';
-		$str .= '<= '.str_replace("\n","",var_export($res,TRUE));
-		phpCAS::log($str);
-		}
-	
-	/**
-	 * This method is used to indicate the end of the execution of the program
-	 */
-	function traceExit()
-		{
-		global $PHPCAS_DEBUG;
-		
-		phpCAS::log('exit()');
-		while ( $PHPCAS_DEBUG['indent'] > 0 ) {
-			phpCAS::log('-');
-			$PHPCAS_DEBUG['indent'] --;
-		}
-		}
-	
-	/** @} */
-	// ########################################################################
-	//  INTERNATIONALIZATION
-	// ########################################################################
-	/**
-	 * @addtogroup publicLang
-	 * @{
-	 */
-	
-	/**
-	 * This method is used to set the language used by phpCAS. 
-	 * @note Can be called only once.
-	 *
-	 * @param $lang a string representing the language.
-	 *
-	 * @sa PHPCAS_LANG_FRENCH, PHPCAS_LANG_ENGLISH
-	 */
-	function setLang($lang)
-		{
-		global $PHPCAS_CLIENT;
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		if ( gettype($lang) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $lang (should be `string\')');
-		}
-		$PHPCAS_CLIENT->setLang($lang);
-		}
-	
-	/** @} */
-	// ########################################################################
-	//  VERSION
-	// ########################################################################
-	/**
-	 * @addtogroup public
-	 * @{
-	 */
-	
-	/**
-	 * This method returns the phpCAS version.
-	 *
-	 * @return the phpCAS version.
-	 */
-	function getVersion()
-		{
-		return PHPCAS_VERSION;
-		}
-	
-	/** @} */
-	// ########################################################################
-	//  HTML OUTPUT
-	// ########################################################################
-	/**
-	 * @addtogroup publicOutput
-	 * @{
-	 */
-	
-	/**
-	 * This method sets the HTML header used for all outputs.
-	 *
-	 * @param $header the HTML header.
-	 */
-	function setHTMLHeader($header)
-		{
-		global $PHPCAS_CLIENT;
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		if ( gettype($header) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $header (should be `string\')');
-		}
-		$PHPCAS_CLIENT->setHTMLHeader($header);
-		}
-	
-	/**
-	 * This method sets the HTML footer used for all outputs.
-	 *
-	 * @param $footer the HTML footer.
-	 */
-	function setHTMLFooter($footer)
-		{
-		global $PHPCAS_CLIENT;
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		if ( gettype($footer) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $footer (should be `string\')');
-		}
-		$PHPCAS_CLIENT->setHTMLFooter($footer);
-		}
-	
-	/** @} */
-	// ########################################################################
-	//  PGT STORAGE
-	// ########################################################################
-	/**
-	 * @addtogroup publicPGTStorage
-	 * @{
-	 */
-	
-	/**
-	 * This method is used to tell phpCAS to store the response of the
-	 * CAS server to PGT requests onto the filesystem. 
-	 *
-	 * @param $format the format used to store the PGT's (`plain' and `xml' allowed)
-	 * @param $path the path where the PGT's should be stored
-	 */
-	function setPGTStorageFile($format='',
-		$path='')
-		{
-		global $PHPCAS_CLIENT,$PHPCAS_AUTH_CHECK_CALL;
-		
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}
-		if ( !$PHPCAS_CLIENT->isProxy() ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}
-		if ( $PHPCAS_AUTH_CHECK_CALL['done'] ) {
-			phpCAS::error('this method should only be called before '.$PHPCAS_AUTH_CHECK_CALL['method'].'() (called at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].')');
-		}
-		if ( gettype($format) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $format (should be `string\')');
-		}
-		if ( gettype($path) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $format (should be `string\')');
-		}
-		$PHPCAS_CLIENT->setPGTStorageFile($format,$path);
-		phpCAS::traceEnd();
-		}
-	
-	/**
-	 * This method is used to tell phpCAS to store the response of the
-	 * CAS server to PGT requests into a database. 
-	 * @note The connection to the database is done only when needed. 
-	 * As a consequence, bad parameters are detected only when 
-	 * initializing PGT storage, except in debug mode.
-	 *
-	 * @param $user the user to access the data with
-	 * @param $password the user's password
-	 * @param $database_type the type of the database hosting the data
-	 * @param $hostname the server hosting the database
-	 * @param $port the port the server is listening on
-	 * @param $database the name of the database
-	 * @param $table the name of the table storing the data
-	 */
-	function setPGTStorageDB($user,
-							 $password,
-							 $database_type='',
-								 $hostname='',
-									 $port=0,
-										 $database='',
-											 $table='')
-		{
-		global $PHPCAS_CLIENT,$PHPCAS_AUTH_CHECK_CALL;
-		
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}
-		if ( !$PHPCAS_CLIENT->isProxy() ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}
-		if ( $PHPCAS_AUTH_CHECK_CALL['done'] ) {
-			phpCAS::error('this method should only be called before '.$PHPCAS_AUTH_CHECK_CALL['method'].'() (called at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].')');
-		}
-		if ( gettype($user) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $user (should be `string\')');
-		}
-		if ( gettype($password) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $password (should be `string\')');
-		}
-		if ( gettype($database_type) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $database_type (should be `string\')');
-		}
-		if ( gettype($hostname) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $hostname (should be `string\')');
-		}
-		if ( gettype($port) != 'integer' ) {
-			phpCAS::error('type mismatched for parameter $port (should be `integer\')');
-		}
-		if ( gettype($database) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $database (should be `string\')');
-		}
-		if ( gettype($table) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $table (should be `string\')');
-		}
-		$PHPCAS_CLIENT->setPGTStorageDB($this,$user,$password,$hostname,$port,$database,$table);
-		phpCAS::traceEnd();
-		}
-	
-	/** @} */
-	// ########################################################################
-	// ACCESS TO EXTERNAL SERVICES
-	// ########################################################################
-	/**
-	 * @addtogroup publicServices
-	 * @{
-	 */
-	
-	/**
-	 * This method is used to access an HTTP[S] service.
-	 * 
-	 * @param $url the service to access.
-	 * @param $err_code an error code Possible values are PHPCAS_SERVICE_OK (on
-	 * success), PHPCAS_SERVICE_PT_NO_SERVER_RESPONSE, PHPCAS_SERVICE_PT_BAD_SERVER_RESPONSE,
-	 * PHPCAS_SERVICE_PT_FAILURE, PHPCAS_SERVICE_NOT AVAILABLE.
-	 * @param $output the output of the service (also used to give an error
-	 * message on failure).
-	 *
-	 * @return TRUE on success, FALSE otherwise (in this later case, $err_code
-	 * gives the reason why it failed and $output contains an error message).
-	 */
-	function serviceWeb($url,&$err_code,&$output)
-		{
-		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;
-		
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}
-		if ( !$PHPCAS_CLIENT->isProxy() ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}
-		if ( !$PHPCAS_AUTH_CHECK_CALL['done'] ) {
-			phpCAS::error('this method should only be called after the programmer is sure the user has been authenticated (by calling '.__CLASS__.'::checkAuthentication() or '.__CLASS__.'::forceAuthentication()');
-		}
-		if ( !$PHPCAS_AUTH_CHECK_CALL['result'] ) {
-			phpCAS::error('authentication was checked (by '.$PHPCAS_AUTH_CHECK_CALL['method'].'() at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].') but the method returned FALSE');
-		}
-		if ( gettype($url) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $url (should be `string\')');
-		}
-		
-		$res = $PHPCAS_CLIENT->serviceWeb($url,$err_code,$output);
-		
-		phpCAS::traceEnd($res);
-		return $res;
-		}
-	
-	/**
-	 * This method is used to access an IMAP/POP3/NNTP service.
-	 * 
-	 * @param $url a string giving the URL of the service, including the mailing box
-	 * for IMAP URLs, as accepted by imap_open().
-	 * @param $flags options given to imap_open().
-	 * @param $err_code an error code Possible values are PHPCAS_SERVICE_OK (on
-	 * success), PHPCAS_SERVICE_PT_NO_SERVER_RESPONSE, PHPCAS_SERVICE_PT_BAD_SERVER_RESPONSE,
-	 * PHPCAS_SERVICE_PT_FAILURE, PHPCAS_SERVICE_NOT AVAILABLE.
-	 * @param $err_msg an error message on failure
-	 * @param $pt the Proxy Ticket (PT) retrieved from the CAS server to access the URL
-	 * on success, FALSE on error).
-	 *
-	 * @return an IMAP stream on success, FALSE otherwise (in this later case, $err_code
-	 * gives the reason why it failed and $err_msg contains an error message).
-	 */
-	function serviceMail($url,$flags,&$err_code,&$err_msg,&$pt)
-		{
-		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;
-		
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}
-		if ( !$PHPCAS_CLIENT->isProxy() ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}
-		if ( !$PHPCAS_AUTH_CHECK_CALL['done'] ) {
-			phpCAS::error('this method should only be called after the programmer is sure the user has been authenticated (by calling '.__CLASS__.'::checkAuthentication() or '.__CLASS__.'::forceAuthentication()');
-		}
-		if ( !$PHPCAS_AUTH_CHECK_CALL['result'] ) {
-			phpCAS::error('authentication was checked (by '.$PHPCAS_AUTH_CHECK_CALL['method'].'() at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].') but the method returned FALSE');
-		}
-		if ( gettype($url) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $url (should be `string\')');
-		}
-		
-		if ( gettype($flags) != 'integer' ) {
-			phpCAS::error('type mismatched for parameter $flags (should be `integer\')');
-		}
-		
-		$res = $PHPCAS_CLIENT->serviceMail($url,$flags,$err_code,$err_msg,$pt);
-		
-		phpCAS::traceEnd($res);
-		return $res;
-		}
-	
-	/** @} */
-	// ########################################################################
-	//  AUTHENTICATION
-	// ########################################################################
-	/**
-	 * @addtogroup publicAuth
-	 * @{
-	 */
-	
-	/**
-	 * Set the times authentication will be cached before really accessing the CAS server in gateway mode: 
-	 * - -1: check only once, and then never again (until you pree login)
-	 * - 0: always check
-	 * - n: check every "n" time
-	 *
-	 * @param $n an integer.
-	 */
-	function setCacheTimesForAuthRecheck($n)
-		{
-		global $PHPCAS_CLIENT;
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		if ( gettype($n) != 'integer' ) {
-			phpCAS::error('type mismatched for parameter $header (should be `string\')');
-		}
-		$PHPCAS_CLIENT->setCacheTimesForAuthRecheck($n);
-		}
-	
-	/**
-	 * This method is called to check if the user is authenticated (use the gateway feature).
-	 * @return TRUE when the user is authenticated; otherwise FALSE.
-	 */
-	function checkAuthentication()
-		{
-		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;
-		
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		
-		$auth = $PHPCAS_CLIENT->checkAuthentication();
-		
-		// store where the authentication has been checked and the result
-		$dbg = phpCAS::backtrace();
-		$PHPCAS_AUTH_CHECK_CALL = array('done' => TRUE,
-			'file' => $dbg[0]['file'],
-			'line' => $dbg[0]['line'],
-			'method' => __CLASS__.'::'.__FUNCTION__,
-			'result' => $auth );
-		phpCAS::traceEnd($auth);
-		return $auth; 
-		}
-	
-	/**
-	 * This method is called to force authentication if the user was not already 
-	 * authenticated. If the user is not authenticated, halt by redirecting to 
-	 * the CAS server.
-	 */
-	function forceAuthentication()
-		{
-		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;
-		
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		
-		$auth = $PHPCAS_CLIENT->forceAuthentication();
-		
-		// store where the authentication has been checked and the result
-		$dbg = phpCAS::backtrace();
-		$PHPCAS_AUTH_CHECK_CALL = array('done' => TRUE,
-			'file' => $dbg[0]['file'],
-			'line' => $dbg[0]['line'],
-			'method' => __CLASS__.'::'.__FUNCTION__,
-			'result' => $auth );
-		
-		if ( !$auth ) {
-			phpCAS::trace('user is not authenticated, redirecting to the CAS server');
-			$PHPCAS_CLIENT->forceAuthentication();
-		} else {
-			phpCAS::trace('no need to authenticate (user `'.phpCAS::getUser().'\' is already authenticated)');
-		}
-		
-		phpCAS::traceEnd();
-		return $auth; 
-		}
-	
-	/**
-	 * This method is called to renew the authentication.
-	 **/
-	function renewAuthentication() {
-		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;
-		
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before'.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		
-		// store where the authentication has been checked and the result
-		$dbg = phpCAS::backtrace();
-		$PHPCAS_AUTH_CHECK_CALL = array('done' => TRUE, 'file' => $dbg[0]['file'], 'line' => $dbg[0]['line'], 'method' => __CLASS__.'::'.__FUNCTION__, 'result' => $auth );
-		
-		$PHPCAS_CLIENT->renewAuthentication();
-		phpCAS::traceEnd();
-	}
-
-	/**
-	 * This method has been left from version 0.4.1 for compatibility reasons.
-	 */
-	function authenticate()
-		{
-		phpCAS::error('this method is deprecated. You should use '.__CLASS__.'::forceAuthentication() instead');
-		}
-	
-	/**
-	 * This method is called to check if the user is authenticated (previously or by
-	 * tickets given in the URL).
-	 *
-	 * @return TRUE when the user is authenticated.
-	 */
-	function isAuthenticated()
-		{
-		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;
-		
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		
-		// call the isAuthenticated method of the global $PHPCAS_CLIENT object
-		$auth = $PHPCAS_CLIENT->isAuthenticated();
-		
-		// store where the authentication has been checked and the result
-		$dbg = phpCAS::backtrace();
-		$PHPCAS_AUTH_CHECK_CALL = array('done' => TRUE,
-			'file' => $dbg[0]['file'],
-			'line' => $dbg[0]['line'],
-			'method' => __CLASS__.'::'.__FUNCTION__,
-			'result' => $auth );
-		phpCAS::traceEnd($auth);
-		return $auth;
-		}
-	
-	/**
-	 * Checks whether authenticated based on $_SESSION. Useful to avoid
-	 * server calls.
-	 * @return true if authenticated, false otherwise.
-	 * @since 0.4.22 by Brendan Arnold
-	 */
-	function isSessionAuthenticated ()
-		{
-		global $PHPCAS_CLIENT;
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		return($PHPCAS_CLIENT->isSessionAuthenticated());
-		}
-	
-	/**
-	 * This method returns the CAS user's login name.
-	 * @warning should not be called only after phpCAS::forceAuthentication()
-	 * or phpCAS::checkAuthentication().
-	 *
-	 * @return the login name of the authenticated user
-	 */
-	function getUser()
-		{
-		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		if ( !$PHPCAS_AUTH_CHECK_CALL['done'] ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::forceAuthentication() or '.__CLASS__.'::isAuthenticated()');
-		}
-		if ( !$PHPCAS_AUTH_CHECK_CALL['result'] ) {
-			phpCAS::error('authentication was checked (by '.$PHPCAS_AUTH_CHECK_CALL['method'].'() at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].') but the method returned FALSE');
-		}
-		return $PHPCAS_CLIENT->getUser();
-		}
-	
-    /**
-     * Handle logout requests.
-     */
-    function handleLogoutRequests($check_client=true, $allowed_clients=false)
-        {
-            global $PHPCAS_CLIENT;
-            if ( !is_object($PHPCAS_CLIENT) ) {
-                phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-            }
-            return($PHPCAS_CLIENT->handleLogoutRequests($check_client, $allowed_clients));
-        }
-   
-	/**
-	 * This method returns the URL to be used to login.
-	 * or phpCAS::isAuthenticated().
-	 *
-	 * @return the login name of the authenticated user
-	 */
-	function getServerLoginURL()
-		{
-		global $PHPCAS_CLIENT;
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		return $PHPCAS_CLIENT->getServerLoginURL();
-		}
-	
-	/**
-	 * Set the login URL of the CAS server.
-	 * @param $url the login URL
-	 * @since 0.4.21 by Wyman Chan
-	 */
-	function setServerLoginURL($url='')
-		{
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after
-				'.__CLASS__.'::client()');
-		}
-		if ( gettype($url) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $url (should be
-			`string\')');
-		}
-		$PHPCAS_CLIENT->setServerLoginURL($url);
-		phpCAS::traceEnd();
-		}
-	
-	/**
-	 * This method returns the URL to be used to login.
-	 * or phpCAS::isAuthenticated().
-	 *
-	 * @return the login name of the authenticated user
-	 */
-	function getServerLogoutURL()
-		{
-		global $PHPCAS_CLIENT;
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');
-		}
-		return $PHPCAS_CLIENT->getServerLogoutURL();
-		}
-	
-	/**
-	 * Set the logout URL of the CAS server.
-	 * @param $url the logout URL
-	 * @since 0.4.21 by Wyman Chan
-	 */
-	function setServerLogoutURL($url='')
-		{
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after
-				'.__CLASS__.'::client()');
-		}
-		if ( gettype($url) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $url (should be
-			`string\')');
-		}
-		$PHPCAS_CLIENT->setServerLogoutURL($url);
-		phpCAS::traceEnd();
-		}
-	
-	/**
-	 * This method is used to logout from CAS.
-	 * @params $params an array that contains the optional url and service parameters that will be passed to the CAS server
-	 * @public
-	 */
-	function logout($params = "") {
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if (!is_object($PHPCAS_CLIENT)) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');
-		}
-		$parsedParams = array();
-		if ($params != "") {
-			if (is_string($params)) {
-				phpCAS::error('method `phpCAS::logout($url)\' is now deprecated, use `phpCAS::logoutWithUrl($url)\' instead');
-			}
-			if (!is_array($params)) {
-				phpCAS::error('type mismatched for parameter $params (should be `array\')');
-			}
-			foreach ($params as $key => $value) {
-				if ($key != "service" && $key != "url") {
-					phpCAS::error('only `url\' and `service\' parameters are allowed for method `phpCAS::logout($params)\'');
-				}
-				$parsedParams[$key] = $value;
-			}
-		}
-		$PHPCAS_CLIENT->logout($parsedParams);
-		// never reached
-		phpCAS::traceEnd();
-	}
-	
-	/**
-	 * This method is used to logout from CAS. Halts by redirecting to the CAS server.
-	 * @param $service a URL that will be transmitted to the CAS server
-	 */
-	function logoutWithRedirectService($service) {
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');
-		}
-		if (!is_string($service)) {
-			phpCAS::error('type mismatched for parameter $service (should be `string\')');
-		}
-		$PHPCAS_CLIENT->logout(array("service" => $service));
-		// never reached
-		phpCAS::traceEnd();
-	}
-	
-	/**
-	 * This method is used to logout from CAS. Halts by redirecting to the CAS server.
-	 * @param $url a URL that will be transmitted to the CAS server
-	 */
-	function logoutWithUrl($url) {
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');
-		}
-		if (!is_string($url)) {
-			phpCAS::error('type mismatched for parameter $url (should be `string\')');
-		}
-		$PHPCAS_CLIENT->logout(array("url" => $url));
-		// never reached
-		phpCAS::traceEnd();
-	}
-	
-	/**
-	 * This method is used to logout from CAS. Halts by redirecting to the CAS server.
-	 * @param $service a URL that will be transmitted to the CAS server
-	 * @param $url a URL that will be transmitted to the CAS server
-	 */
-	function logoutWithRedirectServiceAndUrl($service, $url) {
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');
-		}
-		if (!is_string($service)) {
-			phpCAS::error('type mismatched for parameter $service (should be `string\')');
-		}
-		if (!is_string($url)) {
-			phpCAS::error('type mismatched for parameter $url (should be `string\')');
-		}
-		$PHPCAS_CLIENT->logout(array("service" => $service, "url" => $url));
-		// never reached
-		phpCAS::traceEnd();
-	}
-	
-	/**
-	 * Set the fixed URL that will be used by the CAS server to transmit the PGT.
-	 * When this method is not called, a phpCAS script uses its own URL for the callback.
-	 *
-	 * @param $url the URL
-	 */
-	function setFixedCallbackURL($url='')
-		{
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}
-		if ( !$PHPCAS_CLIENT->isProxy() ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}
-		if ( gettype($url) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $url (should be `string\')');
-		}
-		$PHPCAS_CLIENT->setCallbackURL($url);
-		phpCAS::traceEnd();
-		}
-	
-	/**
-	 * Set the fixed URL that will be set as the CAS service parameter. When this
-	 * method is not called, a phpCAS script uses its own URL.
-	 *
-	 * @param $url the URL
-	 */
-	function setFixedServiceURL($url)
-		{
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}  
-		if ( gettype($url) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $url (should be `string\')');
-		}
-		$PHPCAS_CLIENT->setURL($url);
-		phpCAS::traceEnd();
-		}
-	
-	/**
-	 * Get the URL that is set as the CAS service parameter.
-	 */
-	function getServiceURL()
-		{
-		global $PHPCAS_CLIENT;
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}  
-		return($PHPCAS_CLIENT->getURL());
-		}
-	
-	/**
-	 * Retrieve a Proxy Ticket from the CAS server.
-	 */
-	function retrievePT($target_service,&$err_code,&$err_msg)
-		{
-		global $PHPCAS_CLIENT;
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');
-		}  
-		if ( gettype($target_service) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $target_service(should be `string\')');
-		}
-		return($PHPCAS_CLIENT->retrievePT($target_service,$err_code,$err_msg));
-		}
-	
-	/**
-	 * Set the certificate of the CAS server.
-	 *
-	 * @param $cert the PEM certificate
-	 */
-	function setCasServerCert($cert)
-		{
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');
-		}  
-		if ( gettype($cert) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $cert (should be `string\')');
-		}
-		$PHPCAS_CLIENT->setCasServerCert($cert);
-		phpCAS::traceEnd();
-		}
-	
-	/**
-	 * Set the certificate of the CAS server CA.
-	 *
-	 * @param $cert the CA certificate
-	 */
-	function setCasServerCACert($cert)
-		{
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');
-		}  
-		if ( gettype($cert) != 'string' ) {
-			phpCAS::error('type mismatched for parameter $cert (should be `string\')');
-		}
-		$PHPCAS_CLIENT->setCasServerCACert($cert);
-		phpCAS::traceEnd();
-		}
-	
-	/**
-	 * Set no SSL validation for the CAS server.
-	 */
-	function setNoCasServerValidation()
-		{
-		global $PHPCAS_CLIENT;
-		phpCAS::traceBegin();
-		if ( !is_object($PHPCAS_CLIENT) ) {
-			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');
-		}  
-		$PHPCAS_CLIENT->setNoCasServerValidation();
-		phpCAS::traceEnd();
-		}
-	
-	/** @} */
-	
-  /**
-   * Change CURL options.
-   * CURL is used to connect through HTTPS to CAS server
-   * @param $key the option key
-   * @param $value the value to set
-   */
-   function setExtraCurlOption($key, $value)
-		{
-		  global $PHPCAS_CLIENT;
-		  phpCAS::traceBegin();
-		  if ( !is_object($PHPCAS_CLIENT) ) {
-		  	phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');
-		  }  
-		  $PHPCAS_CLIENT->setExtraCurlOption($key, $value);
-		  phpCAS::traceEnd();
-		}
-
-}
-
-// ########################################################################
-// DOCUMENTATION
-// ########################################################################
-
-// ########################################################################
-//  MAIN PAGE
-
-/**
- * @mainpage
- *
- * The following pages only show the source documentation.
- *
- */
-
-// ########################################################################
-//  MODULES DEFINITION
-
-/** @defgroup public User interface */
-
-/** @defgroup publicInit Initialization
- *  @ingroup public */
-
-/** @defgroup publicAuth Authentication
- *  @ingroup public */
-
-/** @defgroup publicServices Access to external services
- *  @ingroup public */
-
-/** @defgroup publicConfig Configuration
- *  @ingroup public */
-
-/** @defgroup publicLang Internationalization
- *  @ingroup publicConfig */
-
-/** @defgroup publicOutput HTML output
- *  @ingroup publicConfig */
-
-/** @defgroup publicPGTStorage PGT storage
- *  @ingroup publicConfig */
-
-/** @defgroup publicDebug Debugging
- *  @ingroup public */
-
-
-/** @defgroup internal Implementation */
-
-/** @defgroup internalAuthentication Authentication
- *  @ingroup internal */
-
-/** @defgroup internalBasic CAS Basic client features (CAS 1.0, Service Tickets)
- *  @ingroup internal */
-
-/** @defgroup internalProxy CAS Proxy features (CAS 2.0, Proxy Granting Tickets)
- *  @ingroup internal */
-
-/** @defgroup internalPGTStorage PGT storage
- *  @ingroup internalProxy */
-
-/** @defgroup internalPGTStorageDB PGT storage in a database
- *  @ingroup internalPGTStorage */
-
-/** @defgroup internalPGTStorageFile PGT storage on the filesystem
- *  @ingroup internalPGTStorage */
-
-/** @defgroup internalCallback Callback from the CAS server
- *  @ingroup internalProxy */
-
-/** @defgroup internalProxied CAS proxied client features (CAS 2.0, Proxy Tickets)
- *  @ingroup internal */
-
-/** @defgroup internalConfig Configuration
- *  @ingroup internal */
-
-/** @defgroup internalOutput HTML output
- *  @ingroup internalConfig */
-
-/** @defgroup internalLang Internationalization
- *  @ingroup internalConfig
- *
- * To add a new language:
- * - 1. define a new constant PHPCAS_LANG_XXXXXX in CAS/CAS.php
- * - 2. copy any file from CAS/languages to CAS/languages/XXXXXX.php
- * - 3. Make the translations
- */
-
-/** @defgroup internalDebug Debugging
- *  @ingroup internal */
-
-/** @defgroup internalMisc Miscellaneous
- *  @ingroup internal */
-
-// ########################################################################
-//  EXAMPLES
-
-/**
- * @example example_simple.php
- */
- /**
-  * @example example_proxy.php
-  */
-  /**
-   * @example example_proxy2.php
-   */
-   /**
-    * @example example_lang.php
-    */
-    /**
-     * @example example_html.php
-     */
-     /**
-      * @example example_file.php
-      */
-      /**
-       * @example example_db.php
-       */
-       /**
-        * @example example_service.php
-        */
-        /**
-         * @example example_session_proxy.php
-         */
-         /**
-          * @example example_session_service.php
-          */
-          /**
-           * @example example_gateway.php
-           */
-
-
-
-?>
+<?php

+

+// commented in 0.4.22-RC2 for Sylvain Derosiaux

+// error_reporting(E_ALL ^ E_NOTICE);

+

+//

+// hack by Vangelis Haniotakis to handle the absence of $_SERVER['REQUEST_URI'] in IIS

+//

+if (!$_SERVER['REQUEST_URI']) {

+	$_SERVER['REQUEST_URI'] = $_SERVER['SCRIPT_NAME'].'?'.$_SERVER['QUERY_STRING'];

+}

+

+//

+// another one by Vangelis Haniotakis also to make phpCAS work with PHP5

+//

+if (version_compare(PHP_VERSION,'5','>=')) {

+	require_once(dirname(__FILE__).'/CAS/domxml-php4-to-php5.php');

+}

+

+/**

+ * @file CAS/CAS.php

+ * Interface class of the phpCAS library

+ *

+ * @ingroup public

+ */

+

+// ########################################################################

+//  CONSTANTS

+// ########################################################################

+

+// ------------------------------------------------------------------------

+//  CAS VERSIONS

+// ------------------------------------------------------------------------

+

+/**

+ * phpCAS version. accessible for the user by phpCAS::getVersion().

+ */

+define('PHPCAS_VERSION','1.1.0RC6');

+

+// ------------------------------------------------------------------------

+//  CAS VERSIONS

+// ------------------------------------------------------------------------

+ /**

+  * @addtogroup public

+  * @{

+  */

+

+/**

+ * CAS version 1.0

+ */

+define("CAS_VERSION_1_0",'1.0');

+/*!

+ * CAS version 2.0

+ */

+define("CAS_VERSION_2_0",'2.0');

+

+// ------------------------------------------------------------------------

+//  SAML defines

+// ------------------------------------------------------------------------

+

+/**

+ * SAML protocol

+ */

+define("SAML_VERSION_1_1", 'S1');

+

+/**

+ * XML header for SAML POST

+ */

+define("SAML_XML_HEADER", '<?xml version="1.0" encoding="UTF-8"?>');

+

+/**

+ * SOAP envelope for SAML POST

+ */

+define ("SAML_SOAP_ENV", '<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Header/>');

+

+/**

+ * SOAP body for SAML POST

+ */

+define ("SAML_SOAP_BODY", '<SOAP-ENV:Body>');

+

+/**

+ * SAMLP request

+ */

+define ("SAMLP_REQUEST", '<samlp:Request xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"  MajorVersion="1" MinorVersion="1" RequestID="_192.168.16.51.1024506224022" IssueInstant="2002-06-19T17:03:44.022Z">');

+define ("SAMLP_REQUEST_CLOSE", '</samlp:Request>');

+

+/**

+ * SAMLP artifact tag (for the ticket)

+ */

+define ("SAML_ASSERTION_ARTIFACT", '<samlp:AssertionArtifact>');

+

+/**

+ * SAMLP close

+ */

+define ("SAML_ASSERTION_ARTIFACT_CLOSE", '</samlp:AssertionArtifact>');

+

+/**

+ * SOAP body close

+ */

+define ("SAML_SOAP_BODY_CLOSE", '</SOAP-ENV:Body>');

+

+/**

+ * SOAP envelope close

+ */

+define ("SAML_SOAP_ENV_CLOSE", '</SOAP-ENV:Envelope>');

+

+/**

+ * SAML Attributes

+ */

+define("SAML_ATTRIBUTES", 'SAMLATTRIBS');

+

+

+

+/** @} */

+ /**

+  * @addtogroup publicPGTStorage

+  * @{

+  */

+// ------------------------------------------------------------------------

+//  FILE PGT STORAGE

+// ------------------------------------------------------------------------

+ /**

+  * Default path used when storing PGT's to file

+  */

+define("CAS_PGT_STORAGE_FILE_DEFAULT_PATH",'/tmp');

+/**

+ * phpCAS::setPGTStorageFile()'s 2nd parameter to write plain text files

+ */

+define("CAS_PGT_STORAGE_FILE_FORMAT_PLAIN",'plain');

+/**

+ * phpCAS::setPGTStorageFile()'s 2nd parameter to write xml files

+ */

+define("CAS_PGT_STORAGE_FILE_FORMAT_XML",'xml');

+/**

+ * Default format used when storing PGT's to file

+ */

+define("CAS_PGT_STORAGE_FILE_DEFAULT_FORMAT",CAS_PGT_STORAGE_FILE_FORMAT_PLAIN);

+// ------------------------------------------------------------------------

+//  DATABASE PGT STORAGE

+// ------------------------------------------------------------------------

+ /**

+  * default database type when storing PGT's to database

+  */

+define("CAS_PGT_STORAGE_DB_DEFAULT_DATABASE_TYPE",'mysql');

+/**

+ * default host when storing PGT's to database

+ */

+define("CAS_PGT_STORAGE_DB_DEFAULT_HOSTNAME",'localhost');

+/**

+ * default port when storing PGT's to database

+ */

+define("CAS_PGT_STORAGE_DB_DEFAULT_PORT",'');

+/**

+ * default database when storing PGT's to database

+ */

+define("CAS_PGT_STORAGE_DB_DEFAULT_DATABASE",'phpCAS');

+/**

+ * default table when storing PGT's to database

+ */

+define("CAS_PGT_STORAGE_DB_DEFAULT_TABLE",'pgt');

+

+/** @} */

+// ------------------------------------------------------------------------

+// SERVICE ACCESS ERRORS

+// ------------------------------------------------------------------------

+ /**

+  * @addtogroup publicServices

+  * @{

+  */

+

+/**

+ * phpCAS::service() error code on success

+ */

+define("PHPCAS_SERVICE_OK",0);

+/**

+ * phpCAS::service() error code when the PT could not retrieve because

+ * the CAS server did not respond.

+ */

+define("PHPCAS_SERVICE_PT_NO_SERVER_RESPONSE",1);

+/**

+ * phpCAS::service() error code when the PT could not retrieve because

+ * the response of the CAS server was ill-formed.

+ */

+define("PHPCAS_SERVICE_PT_BAD_SERVER_RESPONSE",2);

+/**

+ * phpCAS::service() error code when the PT could not retrieve because

+ * the CAS server did not want to.

+ */

+define("PHPCAS_SERVICE_PT_FAILURE",3);

+/**

+ * phpCAS::service() error code when the service was not available.

+ */

+define("PHPCAS_SERVICE_NOT AVAILABLE",4);

+

+/** @} */

+// ------------------------------------------------------------------------

+//  LANGUAGES

+// ------------------------------------------------------------------------

+ /**

+  * @addtogroup publicLang

+  * @{

+  */

+

+define("PHPCAS_LANG_ENGLISH",    'english');

+define("PHPCAS_LANG_FRENCH",     'french');

+define("PHPCAS_LANG_GREEK",      'greek');

+define("PHPCAS_LANG_GERMAN",     'german');

+define("PHPCAS_LANG_JAPANESE",   'japanese');

+define("PHPCAS_LANG_SPANISH",    'spanish');

+define("PHPCAS_LANG_CATALAN",    'catalan');

+

+/** @} */

+

+/**

+ * @addtogroup internalLang

+ * @{

+ */

+

+/**

+ * phpCAS default language (when phpCAS::setLang() is not used)

+ */

+define("PHPCAS_LANG_DEFAULT", PHPCAS_LANG_ENGLISH);

+

+/** @} */

+// ------------------------------------------------------------------------

+//  DEBUG

+// ------------------------------------------------------------------------

+ /**

+  * @addtogroup publicDebug

+  * @{

+  */

+

+/**

+ * The default directory for the debug file under Unix.

+ */

+define('DEFAULT_DEBUG_DIR','/tmp/');

+

+/** @} */

+// ------------------------------------------------------------------------

+//  MISC

+// ------------------------------------------------------------------------

+ /**

+  * @addtogroup internalMisc

+  * @{

+  */

+

+/**

+ * This global variable is used by the interface class phpCAS.

+ *

+ * @hideinitializer

+ */

+$GLOBALS['PHPCAS_CLIENT']  = null;

+

+/**

+ * This global variable is used to store where the initializer is called from 

+ * (to print a comprehensive error in case of multiple calls).

+ *

+ * @hideinitializer

+ */

+$GLOBALS['PHPCAS_INIT_CALL'] = array('done' => FALSE,

+	'file' => '?',

+	'line' => -1,

+	'method' => '?');

+

+/**

+ * This global variable is used to store where the method checking

+ * the authentication is called from (to print comprehensive errors)

+ *

+ * @hideinitializer

+ */

+$GLOBALS['PHPCAS_AUTH_CHECK_CALL'] = array('done' => FALSE,

+	'file' => '?',

+	'line' => -1,

+	'method' => '?',

+	'result' => FALSE);

+

+/**

+ * This global variable is used to store phpCAS debug mode.

+ *

+ * @hideinitializer

+ */

+$GLOBALS['PHPCAS_DEBUG']  = array('filename' => FALSE,

+	'indent' => 0,

+	'unique_id' => '');

+

+/** @} */

+

+// ########################################################################

+//  CLIENT CLASS

+// ########################################################################

+

+// include client class

+include_once(dirname(__FILE__).'/CAS/client.php');

+

+// ########################################################################

+//  INTERFACE CLASS

+// ########################################################################

+

+/**

+ * @class phpCAS

+ * The phpCAS class is a simple container for the phpCAS library. It provides CAS

+ * authentication for web applications written in PHP.

+ *

+ * @ingroup public

+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>

+ *

+ * \internal All its methods access the same object ($PHPCAS_CLIENT, declared 

+ * at the end of CAS/client.php).

+ */

+

+

+

+class phpCAS

+{

+	

+	// ########################################################################

+	//  INITIALIZATION

+	// ########################################################################

+	

+	/**

+	 * @addtogroup publicInit

+	 * @{

+	 */

+	

+	/**

+	 * phpCAS client initializer.

+	 * @note Only one of the phpCAS::client() and phpCAS::proxy functions should be

+	 * called, only once, and before all other methods (except phpCAS::getVersion()

+	 * and phpCAS::setDebug()).

+	 *

+	 * @param $server_version the version of the CAS server

+	 * @param $server_hostname the hostname of the CAS server

+	 * @param $server_port the port the CAS server is running on

+	 * @param $server_uri the URI the CAS server is responding on

+	 * @param $start_session Have phpCAS start PHP sessions (default true)

+	 *

+	 * @return a newly created CASClient object

+	 */

+	function client($server_version,

+					$server_hostname,

+					$server_port,

+					$server_uri,

+					$start_session = true)

+		{

+		global $PHPCAS_CLIENT, $PHPCAS_INIT_CALL;

+		

+		phpCAS::traceBegin();

+		if ( is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error($PHPCAS_INIT_CALL['method'].'() has already been called (at '.$PHPCAS_INIT_CALL['file'].':'.$PHPCAS_INIT_CALL['line'].')');

+		}

+		if ( gettype($server_version) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $server_version (should be `string\')');

+		}

+		if ( gettype($server_hostname) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $server_hostname (should be `string\')');

+		}

+		if ( gettype($server_port) != 'integer' ) {

+			phpCAS::error('type mismatched for parameter $server_port (should be `integer\')');

+		}

+		if ( gettype($server_uri) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $server_uri (should be `string\')');

+		}

+		

+		// store where the initializer is called from

+		$dbg = phpCAS::backtrace();

+		$PHPCAS_INIT_CALL = array('done' => TRUE,

+			'file' => $dbg[0]['file'],

+			'line' => $dbg[0]['line'],

+			'method' => __CLASS__.'::'.__FUNCTION__);

+		

+		// initialize the global object $PHPCAS_CLIENT

+		$PHPCAS_CLIENT = new CASClient($server_version,FALSE/*proxy*/,$server_hostname,$server_port,$server_uri,$start_session);

+		phpCAS::traceEnd();

+		}

+	

+	/**

+	 * phpCAS proxy initializer.

+	 * @note Only one of the phpCAS::client() and phpCAS::proxy functions should be

+	 * called, only once, and before all other methods (except phpCAS::getVersion()

+	 * and phpCAS::setDebug()).

+	 *

+	 * @param $server_version the version of the CAS server

+	 * @param $server_hostname the hostname of the CAS server

+	 * @param $server_port the port the CAS server is running on

+	 * @param $server_uri the URI the CAS server is responding on

+	 * @param $start_session Have phpCAS start PHP sessions (default true)

+	 *

+	 * @return a newly created CASClient object

+	 */

+	function proxy($server_version,

+				   $server_hostname,

+				   $server_port,

+				   $server_uri,

+				   $start_session = true)

+		{

+		global $PHPCAS_CLIENT, $PHPCAS_INIT_CALL;

+		

+		phpCAS::traceBegin();

+		if ( is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error($PHPCAS_INIT_CALL['method'].'() has already been called (at '.$PHPCAS_INIT_CALL['file'].':'.$PHPCAS_INIT_CALL['line'].')');

+		}

+		if ( gettype($server_version) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $server_version (should be `string\')');

+		}

+		if ( gettype($server_hostname) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $server_hostname (should be `string\')');

+		}

+		if ( gettype($server_port) != 'integer' ) {

+			phpCAS::error('type mismatched for parameter $server_port (should be `integer\')');

+		}

+		if ( gettype($server_uri) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $server_uri (should be `string\')');

+		}

+		

+		// store where the initialzer is called from

+		$dbg = phpCAS::backtrace();

+		$PHPCAS_INIT_CALL = array('done' => TRUE,

+			'file' => $dbg[0]['file'],

+			'line' => $dbg[0]['line'],

+			'method' => __CLASS__.'::'.__FUNCTION__);

+		

+		// initialize the global object $PHPCAS_CLIENT

+		$PHPCAS_CLIENT = new CASClient($server_version,TRUE/*proxy*/,$server_hostname,$server_port,$server_uri,$start_session);

+		phpCAS::traceEnd();

+		}

+	

+	/** @} */

+	// ########################################################################

+	//  DEBUGGING

+	// ########################################################################

+	

+	/**

+	 * @addtogroup publicDebug

+	 * @{

+	 */

+	

+	/**

+	 * Set/unset debug mode

+	 *

+	 * @param $filename the name of the file used for logging, or FALSE to stop debugging.

+	 */

+	function setDebug($filename='')

+		{

+		global $PHPCAS_DEBUG;

+		

+		if ( $filename != FALSE && gettype($filename) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $dbg (should be FALSE or the name of the log file)');

+		}

+		

+		if ( empty($filename) ) {

+			if ( preg_match('/^Win.*/',getenv('OS')) ) {

+				if ( isset($_ENV['TMP']) ) {

+					$debugDir = $_ENV['TMP'].'/';

+				} else if ( isset($_ENV['TEMP']) ) {

+					$debugDir = $_ENV['TEMP'].'/';

+				} else {

+					$debugDir = '';

+				}

+			} else {

+				$debugDir = DEFAULT_DEBUG_DIR;

+			}

+			$filename = $debugDir . 'phpCAS.log';

+		}

+		

+		if ( empty($PHPCAS_DEBUG['unique_id']) ) {

+			$PHPCAS_DEBUG['unique_id'] = substr(strtoupper(md5(uniqid(''))),0,4);

+		}

+		

+		$PHPCAS_DEBUG['filename'] = $filename;

+		

+		phpCAS::trace('START ******************');

+		}

+	

+	/** @} */

+	/**

+	 * @addtogroup internalDebug

+	 * @{

+	 */

+	

+	/**

+	 * This method is a wrapper for debug_backtrace() that is not available 

+	 * in all PHP versions (>= 4.3.0 only)

+	 */

+	function backtrace()

+		{

+		if ( function_exists('debug_backtrace') ) {

+			return debug_backtrace();

+		} else {

+			// poor man's hack ... but it does work ...

+			return array();

+		}

+		}

+	

+	/**

+	 * Logs a string in debug mode.

+	 *

+	 * @param $str the string to write

+	 *

+	 * @private

+	 */

+	function log($str)

+		{

+		$indent_str = ".";

+		global $PHPCAS_DEBUG;

+		

+		if ( $PHPCAS_DEBUG['filename'] ) {

+			for ($i=0;$i<$PHPCAS_DEBUG['indent'];$i++) {

+				$indent_str .= '|    ';

+			}

+			error_log($PHPCAS_DEBUG['unique_id'].' '.$indent_str.$str."\n",3,$PHPCAS_DEBUG['filename']);

+		}

+		

+		}

+	

+	/**

+	 * This method is used by interface methods to print an error and where the function

+	 * was originally called from.

+	 *

+	 * @param $msg the message to print

+	 *

+	 * @private

+	 */

+	function error($msg)

+		{

+		$dbg = phpCAS::backtrace();

+		$function = '?';

+		$file = '?';

+		$line = '?';

+		if ( is_array($dbg) ) {

+			for ( $i=1; $i<sizeof($dbg); $i++) {

+				if ( is_array($dbg[$i]) ) {

+					if ( $dbg[$i]['class'] == __CLASS__ ) {

+						$function = $dbg[$i]['function'];

+						$file = $dbg[$i]['file'];

+						$line = $dbg[$i]['line'];

+					}

+				}

+			}

+		}

+		echo "<br />\n<b>phpCAS error</b>: <font color=\"FF0000\"><b>".__CLASS__."::".$function.'(): '.htmlentities($msg)."</b></font> in <b>".$file."</b> on line <b>".$line."</b><br />\n";

+		phpCAS::trace($msg);

+		phpCAS::traceExit();

+		exit();

+		}

+	

+	/**

+	 * This method is used to log something in debug mode.

+	 */

+	function trace($str)

+		{

+		$dbg = phpCAS::backtrace();

+		phpCAS::log($str.' ['.basename($dbg[1]['file']).':'.$dbg[1]['line'].']');

+		}

+	

+	/**

+	 * This method is used to indicate the start of the execution of a function in debug mode.

+	 */

+	function traceBegin()

+		{

+		global $PHPCAS_DEBUG;

+		

+		$dbg = phpCAS::backtrace();

+		$str = '=> ';

+		if ( !empty($dbg[2]['class']) ) {

+			$str .= $dbg[2]['class'].'::';

+		}

+		$str .= $dbg[2]['function'].'(';      

+		if ( is_array($dbg[2]['args']) ) {

+			foreach ($dbg[2]['args'] as $index => $arg) {

+				if ( $index != 0 ) {

+					$str .= ', ';

+				}

+				$str .= str_replace("\n","",var_export($arg,TRUE));

+			}

+		}

+		$str .= ') ['.basename($dbg[2]['file']).':'.$dbg[2]['line'].']';

+		phpCAS::log($str);

+		$PHPCAS_DEBUG['indent'] ++;

+		}

+	

+	/**

+	 * This method is used to indicate the end of the execution of a function in debug mode.

+	 *

+	 * @param $res the result of the function

+	 */

+	function traceEnd($res='')

+		{

+		global $PHPCAS_DEBUG;

+		

+		$PHPCAS_DEBUG['indent'] --;

+		$dbg = phpCAS::backtrace();

+		$str = '';

+		$str .= '<= '.str_replace("\n","",var_export($res,TRUE));

+		phpCAS::log($str);

+		}

+	

+	/**

+	 * This method is used to indicate the end of the execution of the program

+	 */

+	function traceExit()

+		{

+		global $PHPCAS_DEBUG;

+		

+		phpCAS::log('exit()');

+		while ( $PHPCAS_DEBUG['indent'] > 0 ) {

+			phpCAS::log('-');

+			$PHPCAS_DEBUG['indent'] --;

+		}

+		}

+	

+	/** @} */

+	// ########################################################################

+	//  INTERNATIONALIZATION

+	// ########################################################################

+	/**

+	 * @addtogroup publicLang

+	 * @{

+	 */

+	

+	/**

+	 * This method is used to set the language used by phpCAS. 

+	 * @note Can be called only once.

+	 *

+	 * @param $lang a string representing the language.

+	 *

+	 * @sa PHPCAS_LANG_FRENCH, PHPCAS_LANG_ENGLISH

+	 */

+	function setLang($lang)

+		{

+		global $PHPCAS_CLIENT;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		if ( gettype($lang) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $lang (should be `string\')');

+		}

+		$PHPCAS_CLIENT->setLang($lang);

+		}

+	

+	/** @} */

+	// ########################################################################

+	//  VERSION

+	// ########################################################################

+	/**

+	 * @addtogroup public

+	 * @{

+	 */

+	

+	/**

+	 * This method returns the phpCAS version.

+	 *

+	 * @return the phpCAS version.

+	 */

+	function getVersion()

+		{

+		return PHPCAS_VERSION;

+		}

+	

+	/** @} */

+	// ########################################################################

+	//  HTML OUTPUT

+	// ########################################################################

+	/**

+	 * @addtogroup publicOutput

+	 * @{

+	 */

+	

+	/**

+	 * This method sets the HTML header used for all outputs.

+	 *

+	 * @param $header the HTML header.

+	 */

+	function setHTMLHeader($header)

+		{

+		global $PHPCAS_CLIENT;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		if ( gettype($header) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $header (should be `string\')');

+		}

+		$PHPCAS_CLIENT->setHTMLHeader($header);

+		}

+	

+	/**

+	 * This method sets the HTML footer used for all outputs.

+	 *

+	 * @param $footer the HTML footer.

+	 */

+	function setHTMLFooter($footer)

+		{

+		global $PHPCAS_CLIENT;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		if ( gettype($footer) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $footer (should be `string\')');

+		}

+		$PHPCAS_CLIENT->setHTMLFooter($footer);

+		}

+	

+	/** @} */

+	// ########################################################################

+	//  PGT STORAGE

+	// ########################################################################

+	/**

+	 * @addtogroup publicPGTStorage

+	 * @{

+	 */

+	

+	/**

+	 * This method is used to tell phpCAS to store the response of the

+	 * CAS server to PGT requests onto the filesystem. 

+	 *

+	 * @param $format the format used to store the PGT's (`plain' and `xml' allowed)

+	 * @param $path the path where the PGT's should be stored

+	 */

+	function setPGTStorageFile($format='',

+		$path='')

+		{

+		global $PHPCAS_CLIENT,$PHPCAS_AUTH_CHECK_CALL;

+		

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}

+		if ( !$PHPCAS_CLIENT->isProxy() ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}

+		if ( $PHPCAS_AUTH_CHECK_CALL['done'] ) {

+			phpCAS::error('this method should only be called before '.$PHPCAS_AUTH_CHECK_CALL['method'].'() (called at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].')');

+		}

+		if ( gettype($format) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $format (should be `string\')');

+		}

+		if ( gettype($path) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $format (should be `string\')');

+		}

+		$PHPCAS_CLIENT->setPGTStorageFile($format,$path);

+		phpCAS::traceEnd();

+		}

+	

+	/**

+	 * This method is used to tell phpCAS to store the response of the

+	 * CAS server to PGT requests into a database. 

+	 * @note The connection to the database is done only when needed. 

+	 * As a consequence, bad parameters are detected only when 

+	 * initializing PGT storage, except in debug mode.

+	 *

+	 * @param $user the user to access the data with

+	 * @param $password the user's password

+	 * @param $database_type the type of the database hosting the data

+	 * @param $hostname the server hosting the database

+	 * @param $port the port the server is listening on

+	 * @param $database the name of the database

+	 * @param $table the name of the table storing the data

+	 */

+	function setPGTStorageDB($user,

+							 $password,

+							 $database_type='',

+								 $hostname='',

+									 $port=0,

+										 $database='',

+											 $table='')

+		{

+		global $PHPCAS_CLIENT,$PHPCAS_AUTH_CHECK_CALL;

+		

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}

+		if ( !$PHPCAS_CLIENT->isProxy() ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}

+		if ( $PHPCAS_AUTH_CHECK_CALL['done'] ) {

+			phpCAS::error('this method should only be called before '.$PHPCAS_AUTH_CHECK_CALL['method'].'() (called at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].')');

+		}

+		if ( gettype($user) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $user (should be `string\')');

+		}

+		if ( gettype($password) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $password (should be `string\')');

+		}

+		if ( gettype($database_type) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $database_type (should be `string\')');

+		}

+		if ( gettype($hostname) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $hostname (should be `string\')');

+		}

+		if ( gettype($port) != 'integer' ) {

+			phpCAS::error('type mismatched for parameter $port (should be `integer\')');

+		}

+		if ( gettype($database) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $database (should be `string\')');

+		}

+		if ( gettype($table) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $table (should be `string\')');

+		}

+		$PHPCAS_CLIENT->setPGTStorageDB($user,$password,$database_type,$hostname,$port,$database,$table);

+		phpCAS::traceEnd();

+		}

+	

+	/** @} */

+	// ########################################################################

+	// ACCESS TO EXTERNAL SERVICES

+	// ########################################################################

+	/**

+	 * @addtogroup publicServices

+	 * @{

+	 */

+	

+	/**

+	 * This method is used to access an HTTP[S] service.

+	 * 

+	 * @param $url the service to access.

+	 * @param $err_code an error code Possible values are PHPCAS_SERVICE_OK (on

+	 * success), PHPCAS_SERVICE_PT_NO_SERVER_RESPONSE, PHPCAS_SERVICE_PT_BAD_SERVER_RESPONSE,

+	 * PHPCAS_SERVICE_PT_FAILURE, PHPCAS_SERVICE_NOT AVAILABLE.

+	 * @param $output the output of the service (also used to give an error

+	 * message on failure).

+	 *

+	 * @return TRUE on success, FALSE otherwise (in this later case, $err_code

+	 * gives the reason why it failed and $output contains an error message).

+	 */

+	function serviceWeb($url,&$err_code,&$output)

+		{

+		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;

+		

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}

+		if ( !$PHPCAS_CLIENT->isProxy() ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}

+		if ( !$PHPCAS_AUTH_CHECK_CALL['done'] ) {

+			phpCAS::error('this method should only be called after the programmer is sure the user has been authenticated (by calling '.__CLASS__.'::checkAuthentication() or '.__CLASS__.'::forceAuthentication()');

+		}

+		if ( !$PHPCAS_AUTH_CHECK_CALL['result'] ) {

+			phpCAS::error('authentication was checked (by '.$PHPCAS_AUTH_CHECK_CALL['method'].'() at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].') but the method returned FALSE');

+		}

+		if ( gettype($url) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $url (should be `string\')');

+		}

+		

+		$res = $PHPCAS_CLIENT->serviceWeb($url,$err_code,$output);

+		

+		phpCAS::traceEnd($res);

+		return $res;

+		}

+	

+	/**

+	 * This method is used to access an IMAP/POP3/NNTP service.

+	 * 

+	 * @param $url a string giving the URL of the service, including the mailing box

+	 * for IMAP URLs, as accepted by imap_open().

+	 * @param $service a string giving for CAS retrieve Proxy ticket

+	 * @param $flags options given to imap_open().

+	 * @param $err_code an error code Possible values are PHPCAS_SERVICE_OK (on

+	 * success), PHPCAS_SERVICE_PT_NO_SERVER_RESPONSE, PHPCAS_SERVICE_PT_BAD_SERVER_RESPONSE,

+	 * PHPCAS_SERVICE_PT_FAILURE, PHPCAS_SERVICE_NOT AVAILABLE.

+	 * @param $err_msg an error message on failure

+	 * @param $pt the Proxy Ticket (PT) retrieved from the CAS server to access the URL

+	 * on success, FALSE on error).

+	 *

+	 * @return an IMAP stream on success, FALSE otherwise (in this later case, $err_code

+	 * gives the reason why it failed and $err_msg contains an error message).

+	 */

+	function serviceMail($url,$service,$flags,&$err_code,&$err_msg,&$pt)

+		{

+		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;

+		

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}

+		if ( !$PHPCAS_CLIENT->isProxy() ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}

+		if ( !$PHPCAS_AUTH_CHECK_CALL['done'] ) {

+			phpCAS::error('this method should only be called after the programmer is sure the user has been authenticated (by calling '.__CLASS__.'::checkAuthentication() or '.__CLASS__.'::forceAuthentication()');

+		}

+		if ( !$PHPCAS_AUTH_CHECK_CALL['result'] ) {

+			phpCAS::error('authentication was checked (by '.$PHPCAS_AUTH_CHECK_CALL['method'].'() at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].') but the method returned FALSE');

+		}

+		if ( gettype($url) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $url (should be `string\')');

+		}

+		

+		if ( gettype($flags) != 'integer' ) {

+			phpCAS::error('type mismatched for parameter $flags (should be `integer\')');

+		}

+		

+		$res = $PHPCAS_CLIENT->serviceMail($url,$service,$flags,$err_code,$err_msg,$pt);

+		

+		phpCAS::traceEnd($res);

+		return $res;

+		}

+	

+	/** @} */

+	// ########################################################################

+	//  AUTHENTICATION

+	// ########################################################################

+	/**

+	 * @addtogroup publicAuth

+	 * @{

+	 */

+	

+	/**

+	 * Set the times authentication will be cached before really accessing the CAS server in gateway mode: 

+	 * - -1: check only once, and then never again (until you pree login)

+	 * - 0: always check

+	 * - n: check every "n" time

+	 *

+	 * @param $n an integer.

+	 */

+	function setCacheTimesForAuthRecheck($n)

+		{

+		global $PHPCAS_CLIENT;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		if ( gettype($n) != 'integer' ) {

+			phpCAS::error('type mismatched for parameter $header (should be `string\')');

+		}

+		$PHPCAS_CLIENT->setCacheTimesForAuthRecheck($n);

+		}

+	

+	/**

+	 * This method is called to check if the user is authenticated (use the gateway feature).

+	 * @return TRUE when the user is authenticated; otherwise FALSE.

+	 */

+	function checkAuthentication()

+		{

+		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;

+		

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		

+		$auth = $PHPCAS_CLIENT->checkAuthentication();

+		

+		// store where the authentication has been checked and the result

+		$dbg = phpCAS::backtrace();

+		$PHPCAS_AUTH_CHECK_CALL = array('done' => TRUE,

+			'file' => $dbg[0]['file'],

+			'line' => $dbg[0]['line'],

+			'method' => __CLASS__.'::'.__FUNCTION__,

+			'result' => $auth );

+		phpCAS::traceEnd($auth);

+		return $auth; 

+		}

+

+	/**

+	 * This method is called to force authentication if the user was not already 

+	 * authenticated. If the user is not authenticated, halt by redirecting to 

+	 * the CAS server.

+	 */

+	function forceAuthentication()

+		{

+		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;

+		

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		

+		$auth = $PHPCAS_CLIENT->forceAuthentication();

+		

+		// store where the authentication has been checked and the result

+		$dbg = phpCAS::backtrace();

+		$PHPCAS_AUTH_CHECK_CALL = array('done' => TRUE,

+			'file' => $dbg[0]['file'],

+			'line' => $dbg[0]['line'],

+			'method' => __CLASS__.'::'.__FUNCTION__,

+			'result' => $auth );

+		

+		if ( !$auth ) {

+			phpCAS::trace('user is not authenticated, redirecting to the CAS server');

+			$PHPCAS_CLIENT->forceAuthentication();

+		} else {

+			phpCAS::trace('no need to authenticate (user `'.phpCAS::getUser().'\' is already authenticated)');

+		}

+		

+		phpCAS::traceEnd();

+		return $auth; 

+		}

+	

+	/**

+	 * This method is called to renew the authentication.

+	 **/

+	function renewAuthentication() {

+		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;

+		

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before'.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		

+		// store where the authentication has been checked and the result

+		$dbg = phpCAS::backtrace();

+		$PHPCAS_AUTH_CHECK_CALL = array('done' => TRUE, 'file' => $dbg[0]['file'], 'line' => $dbg[0]['line'], 'method' => __CLASS__.'::'.__FUNCTION__, 'result' => $auth );

+		

+		$PHPCAS_CLIENT->renewAuthentication();

+		phpCAS::traceEnd();

+	}

+

+	/**

+	 * This method has been left from version 0.4.1 for compatibility reasons.

+	 */

+	function authenticate()

+		{

+		phpCAS::error('this method is deprecated. You should use '.__CLASS__.'::forceAuthentication() instead');

+		}

+	

+	/**

+	 * This method is called to check if the user is authenticated (previously or by

+	 * tickets given in the URL).

+	 *

+	 * @return TRUE when the user is authenticated.

+	 */

+	function isAuthenticated()

+		{

+		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;

+		

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		

+		// call the isAuthenticated method of the global $PHPCAS_CLIENT object

+		$auth = $PHPCAS_CLIENT->isAuthenticated();

+		

+		// store where the authentication has been checked and the result

+		$dbg = phpCAS::backtrace();

+		$PHPCAS_AUTH_CHECK_CALL = array('done' => TRUE,

+			'file' => $dbg[0]['file'],

+			'line' => $dbg[0]['line'],

+			'method' => __CLASS__.'::'.__FUNCTION__,

+			'result' => $auth );

+		phpCAS::traceEnd($auth);

+		return $auth;

+		}

+	

+	/**

+	 * Checks whether authenticated based on $_SESSION. Useful to avoid

+	 * server calls.

+	 * @return true if authenticated, false otherwise.

+	 * @since 0.4.22 by Brendan Arnold

+	 */

+	function isSessionAuthenticated ()

+		{

+		global $PHPCAS_CLIENT;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		return($PHPCAS_CLIENT->isSessionAuthenticated());

+		}

+	

+	/**

+	 * This method returns the CAS user's login name.

+	 * @warning should not be called only after phpCAS::forceAuthentication()

+	 * or phpCAS::checkAuthentication().

+	 *

+	 * @return the login name of the authenticated user

+	 */

+	function getUser()

+		{

+		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		if ( !$PHPCAS_AUTH_CHECK_CALL['done'] ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::forceAuthentication() or '.__CLASS__.'::isAuthenticated()');

+		}

+		if ( !$PHPCAS_AUTH_CHECK_CALL['result'] ) {

+			phpCAS::error('authentication was checked (by '.$PHPCAS_AUTH_CHECK_CALL['method'].'() at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].') but the method returned FALSE');

+		}

+		return $PHPCAS_CLIENT->getUser();

+		}

+	

+	/**

+	 * This method returns the CAS user's login name.

+	 * @warning should not be called only after phpCAS::forceAuthentication()

+	 * or phpCAS::checkAuthentication().

+	 *

+	 * @return the login name of the authenticated user

+	 */

+	function getAttributes()

+		{

+		global $PHPCAS_CLIENT, $PHPCAS_AUTH_CHECK_CALL;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		if ( !$PHPCAS_AUTH_CHECK_CALL['done'] ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::forceAuthentication() or '.__CLASS__.'::isAuthenticated()');

+		}

+		if ( !$PHPCAS_AUTH_CHECK_CALL['result'] ) {

+			phpCAS::error('authentication was checked (by '.$PHPCAS_AUTH_CHECK_CALL['method'].'() at '.$PHPCAS_AUTH_CHECK_CALL['file'].':'.$PHPCAS_AUTH_CHECK_CALL['line'].') but the method returned FALSE');

+		}

+		return $PHPCAS_CLIENT->getAttributes();

+		}

+    /**

+     * Handle logout requests.

+     */

+    function handleLogoutRequests($check_client=true, $allowed_clients=false)

+        {

+            global $PHPCAS_CLIENT;

+            if ( !is_object($PHPCAS_CLIENT) ) {

+                phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+            }

+            return($PHPCAS_CLIENT->handleLogoutRequests($check_client, $allowed_clients));

+        }

+   

+	/**

+	 * This method returns the URL to be used to login.

+	 * or phpCAS::isAuthenticated().

+	 *

+	 * @return the login name of the authenticated user

+	 */

+	function getServerLoginURL()

+		{

+		global $PHPCAS_CLIENT;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		return $PHPCAS_CLIENT->getServerLoginURL();

+		}

+	

+	/**

+	 * Set the login URL of the CAS server.

+	 * @param $url the login URL

+	 * @since 0.4.21 by Wyman Chan

+	 */

+	function setServerLoginURL($url='')

+		{

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after

+				'.__CLASS__.'::client()');

+		}

+		if ( gettype($url) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $url (should be

+			`string\')');

+		}

+		$PHPCAS_CLIENT->setServerLoginURL($url);

+		phpCAS::traceEnd();

+		}

+		

+		

+	/**

+	 * Set the serviceValidate URL of the CAS server.

+	 * @param $url the serviceValidate URL

+	 * @since 1.1.0 by Joachim Fritschi

+	 */

+	function setServerServiceValidateURL($url='')

+		{

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after

+				'.__CLASS__.'::client()');

+		}

+		if ( gettype($url) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $url (should be

+			`string\')');

+		}

+		$PHPCAS_CLIENT->setServerServiceValidateURL($url);

+		phpCAS::traceEnd();

+		}

+		

+		

+	 /**

+	 * Set the proxyValidate URL of the CAS server.

+	 * @param $url the proxyValidate URL

+	 * @since 1.1.0 by Joachim Fritschi

+	 */

+	function setServerProxyValidateURL($url='')

+		{

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after

+				'.__CLASS__.'::client()');

+		}

+		if ( gettype($url) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $url (should be

+			`string\')');

+		}

+		$PHPCAS_CLIENT->setServerProxyValidateURL($url);

+		phpCAS::traceEnd();

+		}

+		

+     /**

+	 * Set the samlValidate URL of the CAS server.

+	 * @param $url the samlValidate URL

+	 * @since 1.1.0 by Joachim Fritschi

+	 */

+	function setServerSamlValidateURL($url='')

+		{

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after

+				'.__CLASS__.'::client()');

+		}

+		if ( gettype($url) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $url (should be

+			`string\')');

+		}

+		$PHPCAS_CLIENT->setServerSamlValidateURL($url);

+		phpCAS::traceEnd();

+		}			

+	

+	/**

+	 * This method returns the URL to be used to login.

+	 * or phpCAS::isAuthenticated().

+	 *

+	 * @return the login name of the authenticated user

+	 */

+	function getServerLogoutURL()

+		{

+		global $PHPCAS_CLIENT;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should not be called before '.__CLASS__.'::client() or '.__CLASS__.'::proxy()');

+		}

+		return $PHPCAS_CLIENT->getServerLogoutURL();

+		}

+	

+	/**

+	 * Set the logout URL of the CAS server.

+	 * @param $url the logout URL

+	 * @since 0.4.21 by Wyman Chan

+	 */

+	function setServerLogoutURL($url='')

+		{

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after

+				'.__CLASS__.'::client()');

+		}

+		if ( gettype($url) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $url (should be

+			`string\')');

+		}

+		$PHPCAS_CLIENT->setServerLogoutURL($url);

+		phpCAS::traceEnd();

+		}

+	

+	/**

+	 * This method is used to logout from CAS.

+	 * @params $params an array that contains the optional url and service parameters that will be passed to the CAS server

+	 * @public

+	 */

+	function logout($params = "") {

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if (!is_object($PHPCAS_CLIENT)) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');

+		}

+		$parsedParams = array();

+		if ($params != "") {

+			if (is_string($params)) {

+				phpCAS::error('method `phpCAS::logout($url)\' is now deprecated, use `phpCAS::logoutWithUrl($url)\' instead');

+			}

+			if (!is_array($params)) {

+				phpCAS::error('type mismatched for parameter $params (should be `array\')');

+			}

+			foreach ($params as $key => $value) {

+				if ($key != "service" && $key != "url") {

+					phpCAS::error('only `url\' and `service\' parameters are allowed for method `phpCAS::logout($params)\'');

+				}

+				$parsedParams[$key] = $value;

+			}

+		}

+		$PHPCAS_CLIENT->logout($parsedParams);

+		// never reached

+		phpCAS::traceEnd();

+	}

+	

+	/**

+	 * This method is used to logout from CAS. Halts by redirecting to the CAS server.

+	 * @param $service a URL that will be transmitted to the CAS server

+	 */

+	function logoutWithRedirectService($service) {

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');

+		}

+		if (!is_string($service)) {

+			phpCAS::error('type mismatched for parameter $service (should be `string\')');

+		}

+		$PHPCAS_CLIENT->logout(array("service" => $service));

+		// never reached

+		phpCAS::traceEnd();

+	}

+	

+	/**

+	 * This method is used to logout from CAS. Halts by redirecting to the CAS server.

+	 * @param $url a URL that will be transmitted to the CAS server

+	 */

+	function logoutWithUrl($url) {

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');

+		}

+		if (!is_string($url)) {

+			phpCAS::error('type mismatched for parameter $url (should be `string\')');

+		}

+		$PHPCAS_CLIENT->logout(array("url" => $url));

+		// never reached

+		phpCAS::traceEnd();

+	}

+	

+	/**

+	 * This method is used to logout from CAS. Halts by redirecting to the CAS server.

+	 * @param $service a URL that will be transmitted to the CAS server

+	 * @param $url a URL that will be transmitted to the CAS server

+	 */

+	function logoutWithRedirectServiceAndUrl($service, $url) {

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');

+		}

+		if (!is_string($service)) {

+			phpCAS::error('type mismatched for parameter $service (should be `string\')');

+		}

+		if (!is_string($url)) {

+			phpCAS::error('type mismatched for parameter $url (should be `string\')');

+		}

+		$PHPCAS_CLIENT->logout(array("service" => $service, "url" => $url));

+		// never reached

+		phpCAS::traceEnd();

+	}

+	

+	/**

+	 * Set the fixed URL that will be used by the CAS server to transmit the PGT.

+	 * When this method is not called, a phpCAS script uses its own URL for the callback.

+	 *

+	 * @param $url the URL

+	 */

+	function setFixedCallbackURL($url='')

+		{

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}

+		if ( !$PHPCAS_CLIENT->isProxy() ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}

+		if ( gettype($url) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $url (should be `string\')');

+		}

+		$PHPCAS_CLIENT->setCallbackURL($url);

+		phpCAS::traceEnd();

+		}

+	

+	/**

+	 * Set the fixed URL that will be set as the CAS service parameter. When this

+	 * method is not called, a phpCAS script uses its own URL.

+	 *

+	 * @param $url the URL

+	 */

+	function setFixedServiceURL($url)

+		{

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}  

+		if ( gettype($url) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $url (should be `string\')');

+		}

+		$PHPCAS_CLIENT->setURL($url);

+		phpCAS::traceEnd();

+		}

+	

+	/**

+	 * Get the URL that is set as the CAS service parameter.

+	 */

+	function getServiceURL()

+		{

+		global $PHPCAS_CLIENT;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}  

+		return($PHPCAS_CLIENT->getURL());

+		}

+	

+	/**

+	 * Retrieve a Proxy Ticket from the CAS server.

+	 */

+	function retrievePT($target_service,&$err_code,&$err_msg)

+		{

+		global $PHPCAS_CLIENT;

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::proxy()');

+		}  

+		if ( gettype($target_service) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $target_service(should be `string\')');

+		}

+		return($PHPCAS_CLIENT->retrievePT($target_service,$err_code,$err_msg));

+		}

+	

+	/**

+	 * Set the certificate of the CAS server.

+	 *

+	 * @param $cert the PEM certificate

+	 */

+	function setCasServerCert($cert)

+		{

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');

+		}  

+		if ( gettype($cert) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $cert (should be `string\')');

+		}

+		$PHPCAS_CLIENT->setCasServerCert($cert);

+		phpCAS::traceEnd();

+		}

+	

+	/**

+	 * Set the certificate of the CAS server CA.

+	 *

+	 * @param $cert the CA certificate

+	 */

+	function setCasServerCACert($cert)

+		{

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');

+		}  

+		if ( gettype($cert) != 'string' ) {

+			phpCAS::error('type mismatched for parameter $cert (should be `string\')');

+		}

+		$PHPCAS_CLIENT->setCasServerCACert($cert);

+		phpCAS::traceEnd();

+		}

+	

+	/**

+	 * Set no SSL validation for the CAS server.

+	 */

+	function setNoCasServerValidation()

+		{

+		global $PHPCAS_CLIENT;

+		phpCAS::traceBegin();

+		if ( !is_object($PHPCAS_CLIENT) ) {

+			phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');

+		}  

+		$PHPCAS_CLIENT->setNoCasServerValidation();

+		phpCAS::traceEnd();

+		}

+	

+	/** @} */

+	

+  /**

+   * Change CURL options.

+   * CURL is used to connect through HTTPS to CAS server

+   * @param $key the option key

+   * @param $value the value to set

+   */

+   function setExtraCurlOption($key, $value)

+		{

+		  global $PHPCAS_CLIENT;

+		  phpCAS::traceBegin();

+		  if ( !is_object($PHPCAS_CLIENT) ) {

+		  	phpCAS::error('this method should only be called after '.__CLASS__.'::client() or'.__CLASS__.'::proxy()');

+		  }  

+		  $PHPCAS_CLIENT->setExtraCurlOption($key, $value);

+		  phpCAS::traceEnd();

+		}

+

+}

+

+// ########################################################################

+// DOCUMENTATION

+// ########################################################################

+

+// ########################################################################

+//  MAIN PAGE

+

+/**

+ * @mainpage

+ *

+ * The following pages only show the source documentation.

+ *

+ */

+

+// ########################################################################

+//  MODULES DEFINITION

+

+/** @defgroup public User interface */

+

+/** @defgroup publicInit Initialization

+ *  @ingroup public */

+

+/** @defgroup publicAuth Authentication

+ *  @ingroup public */

+

+/** @defgroup publicServices Access to external services

+ *  @ingroup public */

+

+/** @defgroup publicConfig Configuration

+ *  @ingroup public */

+

+/** @defgroup publicLang Internationalization

+ *  @ingroup publicConfig */

+

+/** @defgroup publicOutput HTML output

+ *  @ingroup publicConfig */

+

+/** @defgroup publicPGTStorage PGT storage

+ *  @ingroup publicConfig */

+

+/** @defgroup publicDebug Debugging

+ *  @ingroup public */

+

+

+/** @defgroup internal Implementation */

+

+/** @defgroup internalAuthentication Authentication

+ *  @ingroup internal */

+

+/** @defgroup internalBasic CAS Basic client features (CAS 1.0, Service Tickets)

+ *  @ingroup internal */

+

+/** @defgroup internalProxy CAS Proxy features (CAS 2.0, Proxy Granting Tickets)

+ *  @ingroup internal */

+

+/** @defgroup internalPGTStorage PGT storage

+ *  @ingroup internalProxy */

+

+/** @defgroup internalPGTStorageDB PGT storage in a database

+ *  @ingroup internalPGTStorage */

+

+/** @defgroup internalPGTStorageFile PGT storage on the filesystem

+ *  @ingroup internalPGTStorage */

+

+/** @defgroup internalCallback Callback from the CAS server

+ *  @ingroup internalProxy */

+

+/** @defgroup internalProxied CAS proxied client features (CAS 2.0, Proxy Tickets)

+ *  @ingroup internal */

+

+/** @defgroup internalConfig Configuration

+ *  @ingroup internal */

+

+/** @defgroup internalOutput HTML output

+ *  @ingroup internalConfig */

+

+/** @defgroup internalLang Internationalization

+ *  @ingroup internalConfig

+ *

+ * To add a new language:

+ * - 1. define a new constant PHPCAS_LANG_XXXXXX in CAS/CAS.php

+ * - 2. copy any file from CAS/languages to CAS/languages/XXXXXX.php

+ * - 3. Make the translations

+ */

+

+/** @defgroup internalDebug Debugging

+ *  @ingroup internal */

+

+/** @defgroup internalMisc Miscellaneous

+ *  @ingroup internal */

+

+// ########################################################################

+//  EXAMPLES

+

+/**

+ * @example example_simple.php

+ */

+ /**

+  * @example example_proxy.php

+  */

+  /**

+   * @example example_proxy2.php

+   */

+   /**

+    * @example example_lang.php

+    */

+    /**

+     * @example example_html.php

+     */

+     /**

+      * @example example_file.php

+      */

+      /**

+       * @example example_db.php

+       */

+       /**

+        * @example example_service.php

+        */

+        /**

+         * @example example_session_proxy.php

+         */

+         /**

+          * @example example_session_service.php

+          */

+          /**

+           * @example example_gateway.php

+           */

+

+

+

+?>

diff --git a/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-db.php b/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-db.php
index 00797b9c5..5a589e4b2 100644
--- a/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-db.php
+++ b/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-db.php
@@ -1,190 +1,190 @@
-<?php
-
-/**
- * @file CAS/PGTStorage/pgt-db.php
- * Basic class for PGT database storage
- */
-
-/**
- * @class PGTStorageDB
- * The PGTStorageDB class is a class for PGT database storage. An instance of 
- * this class is returned by CASClient::SetPGTStorageDB().
- *
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- *
- * @ingroup internalPGTStorageDB
- */
-
-class PGTStorageDB extends PGTStorage
-{
-  /** 
-   * @addtogroup internalPGTStorageDB
-   * @{ 
-   */
-
-  /**
-   * a string representing a PEAR DB URL to connect to the database. Written by
-   * PGTStorageDB::PGTStorageDB(), read by getURL().
-   *
-   * @hideinitializer
-   * @private
-   */
-  var $_url='';
-
-  /**
-   * This method returns the PEAR DB URL to use to connect to the database.
-   *
-   * @return a PEAR DB URL
-   *
-   * @private
-   */
-  function getURL()
-    {
-      return $this->_url;
-    }
-
-  /**
-   * The handle of the connection to the database where PGT's are stored. Written by
-   * PGTStorageDB::init(), read by getLink().
-   *
-   * @hideinitializer
-   * @private
-   */
-  var $_link = null;
-
-  /**
-   * This method returns the handle of the connection to the database where PGT's are 
-   * stored.
-   *
-   * @return a handle of connection.
-   *
-   * @private
-   */
-  function getLink()
-    {
-      return $this->_link;
-    }
-
-  /**
-   * The name of the table where PGT's are stored. Written by 
-   * PGTStorageDB::PGTStorageDB(), read by getTable().
-   *
-   * @hideinitializer
-   * @private
-   */
-  var $_table = '';
-
-  /**
-   * This method returns the name of the table where PGT's are stored.
-   *
-   * @return the name of a table.
-   *
-   * @private
-   */
-  function getTable()
-    {
-      return $this->_table;
-    }
-
-  // ########################################################################
-  //  DEBUGGING
-  // ########################################################################
-  
-  /**
-   * This method returns an informational string giving the type of storage
-   * used by the object (used for debugging purposes).
-   *
-   * @return an informational string.
-   * @public
-   */
-  function getStorageType()
-    {
-      return "database";
-    }
-
-  /**
-   * This method returns an informational string giving informations on the
-   * parameters of the storage.(used for debugging purposes).
-   *
-   * @public
-   */
-  function getStorageInfo()
-    {
-      return 'url=`'.$this->getURL().'\', table=`'.$this->getTable().'\'';
-    }
-
-  // ########################################################################
-  //  CONSTRUCTOR
-  // ########################################################################
-  
-  /**
-   * The class constructor, called by CASClient::SetPGTStorageDB().
-   *
-   * @param $cas_parent the CASClient instance that creates the object.
-   * @param $user the user to access the data with
-   * @param $password the user's password
-   * @param $database_type the type of the database hosting the data
-   * @param $hostname the server hosting the database
-   * @param $port the port the server is listening on
-   * @param $database the name of the database
-   * @param $table the name of the table storing the data
-   *
-   * @public
-   */
-  function PGTStorageDB($cas_parent,$user,$password,$database_type,$hostname,$port,$database,$table)
-    {
-      phpCAS::traceBegin();
-
-      // call the ancestor's constructor
-      $this->PGTStorage($cas_parent);
-
-      if ( empty($database_type) ) $database_type = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE_TYPE;
-      if ( empty($hostname) ) $hostname = CAS_PGT_STORAGE_DB_DEFAULT_HOSTNAME;
-      if ( $port==0 ) $port = CAS_PGT_STORAGE_DB_DEFAULT_PORT;
-      if ( empty($database) ) $database = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE;
-      if ( empty($table) ) $table = CAS_PGT_STORAGE_DB_DEFAULT_TABLE;
-
-      // build and store the PEAR DB URL
-      $this->_url = $database_type.':'.'//'.$user.':'.$password.'@'.$hostname.':'.$port.'/'.$database;
-
-      // XXX should use setURL and setTable
-      phpCAS::traceEnd();
-    }
-  
-  // ########################################################################
-  //  INITIALIZATION
-  // ########################################################################
-  
-  /**
-   * This method is used to initialize the storage. Halts on error.
-   *
-   * @public
-   */
-  function init()
-    {
-      phpCAS::traceBegin();
-      // if the storage has already been initialized, return immediatly
-      if ( $this->isInitialized() )
-		return;
-      // call the ancestor's method (mark as initialized)
-      parent::init();
-      
-	  //include phpDB library (the test was introduced in release 0.4.8 for 
-	  //the integration into Tikiwiki).
-	  if (!class_exists('DB')) {
-		include_once('DB.php');
-	  }
-
-      // try to connect to the database
-      $this->_link = DB::connect($this->getURL());
-      if ( DB::isError($this->_link) ) {
-	phpCAS::error('could not connect to database ('.DB::errorMessage($this->_link).')');
-      }
-      var_dump($this->_link);
-      phpCAS::traceBEnd();
-    }
-
-  /** @} */
-}
-
+<?php

+

+/**

+ * @file CAS/PGTStorage/pgt-db.php

+ * Basic class for PGT database storage

+ */

+

+/**

+ * @class PGTStorageDB

+ * The PGTStorageDB class is a class for PGT database storage. An instance of 

+ * this class is returned by CASClient::SetPGTStorageDB().

+ *

+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>

+ *

+ * @ingroup internalPGTStorageDB

+ */

+

+class PGTStorageDB extends PGTStorage

+{

+  /** 

+   * @addtogroup internalPGTStorageDB

+   * @{ 

+   */

+

+  /**

+   * a string representing a PEAR DB URL to connect to the database. Written by

+   * PGTStorageDB::PGTStorageDB(), read by getURL().

+   *

+   * @hideinitializer

+   * @private

+   */

+  var $_url='';

+

+  /**

+   * This method returns the PEAR DB URL to use to connect to the database.

+   *

+   * @return a PEAR DB URL

+   *

+   * @private

+   */

+  function getURL()

+    {

+      return $this->_url;

+    }

+

+  /**

+   * The handle of the connection to the database where PGT's are stored. Written by

+   * PGTStorageDB::init(), read by getLink().

+   *

+   * @hideinitializer

+   * @private

+   */

+  var $_link = null;

+

+  /**

+   * This method returns the handle of the connection to the database where PGT's are 

+   * stored.

+   *

+   * @return a handle of connection.

+   *

+   * @private

+   */

+  function getLink()

+    {

+      return $this->_link;

+    }

+

+  /**

+   * The name of the table where PGT's are stored. Written by 

+   * PGTStorageDB::PGTStorageDB(), read by getTable().

+   *

+   * @hideinitializer

+   * @private

+   */

+  var $_table = '';

+

+  /**

+   * This method returns the name of the table where PGT's are stored.

+   *

+   * @return the name of a table.

+   *

+   * @private

+   */

+  function getTable()

+    {

+      return $this->_table;

+    }

+

+  // ########################################################################

+  //  DEBUGGING

+  // ########################################################################

+  

+  /**

+   * This method returns an informational string giving the type of storage

+   * used by the object (used for debugging purposes).

+   *

+   * @return an informational string.

+   * @public

+   */

+  function getStorageType()

+    {

+      return "database";

+    }

+

+  /**

+   * This method returns an informational string giving informations on the

+   * parameters of the storage.(used for debugging purposes).

+   *

+   * @public

+   */

+  function getStorageInfo()

+    {

+      return 'url=`'.$this->getURL().'\', table=`'.$this->getTable().'\'';

+    }

+

+  // ########################################################################

+  //  CONSTRUCTOR

+  // ########################################################################

+  

+  /**

+   * The class constructor, called by CASClient::SetPGTStorageDB().

+   *

+   * @param $cas_parent the CASClient instance that creates the object.

+   * @param $user the user to access the data with

+   * @param $password the user's password

+   * @param $database_type the type of the database hosting the data

+   * @param $hostname the server hosting the database

+   * @param $port the port the server is listening on

+   * @param $database the name of the database

+   * @param $table the name of the table storing the data

+   *

+   * @public

+   */

+  function PGTStorageDB($cas_parent,$user,$password,$database_type,$hostname,$port,$database,$table)

+    {

+      phpCAS::traceBegin();

+

+      // call the ancestor's constructor

+      $this->PGTStorage($cas_parent);

+

+      if ( empty($database_type) ) $database_type = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE_TYPE;

+      if ( empty($hostname) ) $hostname = CAS_PGT_STORAGE_DB_DEFAULT_HOSTNAME;

+      if ( $port==0 ) $port = CAS_PGT_STORAGE_DB_DEFAULT_PORT;

+      if ( empty($database) ) $database = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE;

+      if ( empty($table) ) $table = CAS_PGT_STORAGE_DB_DEFAULT_TABLE;

+

+      // build and store the PEAR DB URL

+      $this->_url = $database_type.':'.'//'.$user.':'.$password.'@'.$hostname.':'.$port.'/'.$database;

+

+      // XXX should use setURL and setTable

+      phpCAS::traceEnd();

+    }

+  

+  // ########################################################################

+  //  INITIALIZATION

+  // ########################################################################

+  

+  /**

+   * This method is used to initialize the storage. Halts on error.

+   *

+   * @public

+   */

+  function init()

+    {

+      phpCAS::traceBegin();

+      // if the storage has already been initialized, return immediatly

+      if ( $this->isInitialized() )

+		return;

+      // call the ancestor's method (mark as initialized)

+      parent::init();

+      

+	  //include phpDB library (the test was introduced in release 0.4.8 for 

+	  //the integration into Tikiwiki).

+	  if (!class_exists('DB')) {

+		include_once('DB.php');

+	  }

+

+      // try to connect to the database

+      $this->_link = DB::connect($this->getURL());

+      if ( DB::isError($this->_link) ) {

+	phpCAS::error('could not connect to database ('.DB::errorMessage($this->_link).')');

+      }

+      var_dump($this->_link);

+      phpCAS::traceBEnd();

+    }

+

+  /** @} */

+}

+

 ?>
\ No newline at end of file
diff --git a/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-file.php b/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-file.php
index d48a60d67..bc07485b8 100644
--- a/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-file.php
+++ b/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-file.php
@@ -1,249 +1,249 @@
-<?php
-
-/**
- * @file CAS/PGTStorage/pgt-file.php
- * Basic class for PGT file storage
- */
-
-/**
- * @class PGTStorageFile
- * The PGTStorageFile class is a class for PGT file storage. An instance of 
- * this class is returned by CASClient::SetPGTStorageFile().
- *
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- *
- * @ingroup internalPGTStorageFile
- */
-
-class PGTStorageFile extends PGTStorage
-{
-  /** 
-   * @addtogroup internalPGTStorageFile 
-   * @{ 
-   */
-
-  /**
-   * a string telling where PGT's should be stored on the filesystem. Written by
-   * PGTStorageFile::PGTStorageFile(), read by getPath().
-   *
-   * @private
-   */
-  var $_path;
-
-  /**
-   * This method returns the name of the directory where PGT's should be stored 
-   * on the filesystem.
-   *
-   * @return the name of a directory (with leading and trailing '/')
-   *
-   * @private
-   */
-  function getPath()
-    {
-      return $this->_path;
-    }
-
-  /**
-   * a string telling the format to use to store PGT's (plain or xml). Written by
-   * PGTStorageFile::PGTStorageFile(), read by getFormat().
-   *
-   * @private
-   */
-  var $_format;
-
-  /**
-   * This method returns the format to use when storing PGT's on the filesystem.
-   *
-   * @return a string corresponding to the format used (plain or xml).
-   *
-   * @private
-   */
-  function getFormat()
-    {
-      return $this->_format;
-    }
-
-  // ########################################################################
-  //  DEBUGGING
-  // ########################################################################
-  
-  /**
-   * This method returns an informational string giving the type of storage
-   * used by the object (used for debugging purposes).
-   *
-   * @return an informational string.
-   * @public
-   */
-  function getStorageType()
-    {
-      return "file";
-    }
-
-  /**
-   * This method returns an informational string giving informations on the
-   * parameters of the storage.(used for debugging purposes).
-   *
-   * @return an informational string.
-   * @public
-   */
-  function getStorageInfo()
-    {
-      return 'path=`'.$this->getPath().'\', format=`'.$this->getFormat().'\'';
-    }
-
-  // ########################################################################
-  //  CONSTRUCTOR
-  // ########################################################################
-  
-  /**
-   * The class constructor, called by CASClient::SetPGTStorageFile().
-   *
-   * @param $cas_parent the CASClient instance that creates the object.
-   * @param $format the format used to store the PGT's (`plain' and `xml' allowed).
-   * @param $path the path where the PGT's should be stored
-   *
-   * @public
-   */
-  function PGTStorageFile($cas_parent,$format,$path)
-    {
-      phpCAS::traceBegin();
-      // call the ancestor's constructor
-      $this->PGTStorage($cas_parent);
-
-      if (empty($format) ) $format = CAS_PGT_STORAGE_FILE_DEFAULT_FORMAT;
-      if (empty($path) ) $path = CAS_PGT_STORAGE_FILE_DEFAULT_PATH;
-
-      // check that the path is an absolute path
-      if (getenv("OS")=="Windows_NT"){
-      	
-      	 if (!preg_match('`^[a-zA-Z]:`', $path)) {
-	     	phpCAS::error('an absolute path is needed for PGT storage to file');
-      	}
-      	
-      }
-      else
-      {
-      
-      	if ( $path[0] != '/' ) {
-			phpCAS::error('an absolute path is needed for PGT storage to file');
-      	}
-
-      	// store the path (with a leading and trailing '/')      
-      	$path = preg_replace('|[/]*$|','/',$path);
-      	$path = preg_replace('|^[/]*|','/',$path);
-      }
-      
-      $this->_path = $path;
-      // check the format and store it
-      switch ($format) {
-      case CAS_PGT_STORAGE_FILE_FORMAT_PLAIN:
-      case CAS_PGT_STORAGE_FILE_FORMAT_XML:
-	$this->_format = $format;
-	break;
-      default:
-	phpCAS::error('unknown PGT file storage format (`'.CAS_PGT_STORAGE_FILE_FORMAT_PLAIN.'\' and `'.CAS_PGT_STORAGE_FILE_FORMAT_XML.'\' allowed)');
-      }
-      phpCAS::traceEnd();      
-    }
-
-  // ########################################################################
-  //  INITIALIZATION
-  // ########################################################################
-  
-  /**
-   * This method is used to initialize the storage. Halts on error.
-   *
-   * @public
-   */
-  function init()
-    {
-      phpCAS::traceBegin();
-      // if the storage has already been initialized, return immediatly
-      if ( $this->isInitialized() )
-	return;
-      // call the ancestor's method (mark as initialized)
-      parent::init();
-      phpCAS::traceEnd();      
-    }
-
-  // ########################################################################
-  //  PGT I/O
-  // ########################################################################
-
-  /**
-   * This method returns the filename corresponding to a PGT Iou.
-   *
-   * @param $pgt_iou the PGT iou.
-   *
-   * @return a filename
-   * @private
-   */
-  function getPGTIouFilename($pgt_iou)
-    {
-      phpCAS::traceBegin();
-      $filename = $this->getPath().$pgt_iou.'.'.$this->getFormat();
-      phpCAS::traceEnd($filename);
-      return $filename;
-    }
-  
-  /**
-   * This method stores a PGT and its corresponding PGT Iou into a file. Echoes a
-   * warning on error.
-   *
-   * @param $pgt the PGT
-   * @param $pgt_iou the PGT iou
-   *
-   * @public
-   */
-  function write($pgt,$pgt_iou)
-    {
-      phpCAS::traceBegin();
-      $fname = $this->getPGTIouFilename($pgt_iou);
-      if ( $f=fopen($fname,"w") ) {
-	if ( fputs($f,$pgt) === FALSE ) {
-	  phpCAS::error('could not write PGT to `'.$fname.'\'');
-	}
-	fclose($f);
-      } else {
-	phpCAS::error('could not open `'.$fname.'\'');
-      }
-      phpCAS::traceEnd();      
-    }
-
-  /**
-   * This method reads a PGT corresponding to a PGT Iou and deletes the 
-   * corresponding file.
-   *
-   * @param $pgt_iou the PGT iou
-   *
-   * @return the corresponding PGT, or FALSE on error
-   *
-   * @public
-   */
-  function read($pgt_iou)
-    {
-      phpCAS::traceBegin();
-      $pgt = FALSE;
-      $fname = $this->getPGTIouFilename($pgt_iou);
-      if ( !($f=fopen($fname,"r")) ) {
-	phpCAS::trace('could not open `'.$fname.'\'');
-      } else {
-	if ( ($pgt=fgets($f)) === FALSE ) {
-	  phpCAS::trace('could not read PGT from `'.$fname.'\'');
-	} 
-	fclose($f);
-      }
-
-      // delete the PGT file
-      @unlink($fname);
-
-      phpCAS::traceEnd($pgt);
-      return $pgt;
-    }
-  
-  /** @} */
-  
-}
-
-  
+<?php

+

+/**

+ * @file CAS/PGTStorage/pgt-file.php

+ * Basic class for PGT file storage

+ */

+

+/**

+ * @class PGTStorageFile

+ * The PGTStorageFile class is a class for PGT file storage. An instance of 

+ * this class is returned by CASClient::SetPGTStorageFile().

+ *

+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>

+ *

+ * @ingroup internalPGTStorageFile

+ */

+

+class PGTStorageFile extends PGTStorage

+{

+  /** 

+   * @addtogroup internalPGTStorageFile 

+   * @{ 

+   */

+

+  /**

+   * a string telling where PGT's should be stored on the filesystem. Written by

+   * PGTStorageFile::PGTStorageFile(), read by getPath().

+   *

+   * @private

+   */

+  var $_path;

+

+  /**

+   * This method returns the name of the directory where PGT's should be stored 

+   * on the filesystem.

+   *

+   * @return the name of a directory (with leading and trailing '/')

+   *

+   * @private

+   */

+  function getPath()

+    {

+      return $this->_path;

+    }

+

+  /**

+   * a string telling the format to use to store PGT's (plain or xml). Written by

+   * PGTStorageFile::PGTStorageFile(), read by getFormat().

+   *

+   * @private

+   */

+  var $_format;

+

+  /**

+   * This method returns the format to use when storing PGT's on the filesystem.

+   *

+   * @return a string corresponding to the format used (plain or xml).

+   *

+   * @private

+   */

+  function getFormat()

+    {

+      return $this->_format;

+    }

+

+  // ########################################################################

+  //  DEBUGGING

+  // ########################################################################

+  

+  /**

+   * This method returns an informational string giving the type of storage

+   * used by the object (used for debugging purposes).

+   *

+   * @return an informational string.

+   * @public

+   */

+  function getStorageType()

+    {

+      return "file";

+    }

+

+  /**

+   * This method returns an informational string giving informations on the

+   * parameters of the storage.(used for debugging purposes).

+   *

+   * @return an informational string.

+   * @public

+   */

+  function getStorageInfo()

+    {

+      return 'path=`'.$this->getPath().'\', format=`'.$this->getFormat().'\'';

+    }

+

+  // ########################################################################

+  //  CONSTRUCTOR

+  // ########################################################################

+  

+  /**

+   * The class constructor, called by CASClient::SetPGTStorageFile().

+   *

+   * @param $cas_parent the CASClient instance that creates the object.

+   * @param $format the format used to store the PGT's (`plain' and `xml' allowed).

+   * @param $path the path where the PGT's should be stored

+   *

+   * @public

+   */

+  function PGTStorageFile($cas_parent,$format,$path)

+    {

+      phpCAS::traceBegin();

+      // call the ancestor's constructor

+      $this->PGTStorage($cas_parent);

+

+      if (empty($format) ) $format = CAS_PGT_STORAGE_FILE_DEFAULT_FORMAT;

+      if (empty($path) ) $path = CAS_PGT_STORAGE_FILE_DEFAULT_PATH;

+

+      // check that the path is an absolute path

+      if (getenv("OS")=="Windows_NT"){

+      	

+      	 if (!preg_match('`^[a-zA-Z]:`', $path)) {

+	     	phpCAS::error('an absolute path is needed for PGT storage to file');

+      	}

+      	

+      }

+      else

+      {

+      

+      	if ( $path[0] != '/' ) {

+			phpCAS::error('an absolute path is needed for PGT storage to file');

+      	}

+

+      	// store the path (with a leading and trailing '/')      

+      	$path = preg_replace('|[/]*$|','/',$path);

+      	$path = preg_replace('|^[/]*|','/',$path);

+      }

+      

+      $this->_path = $path;

+      // check the format and store it

+      switch ($format) {

+      case CAS_PGT_STORAGE_FILE_FORMAT_PLAIN:

+      case CAS_PGT_STORAGE_FILE_FORMAT_XML:

+	$this->_format = $format;

+	break;

+      default:

+	phpCAS::error('unknown PGT file storage format (`'.CAS_PGT_STORAGE_FILE_FORMAT_PLAIN.'\' and `'.CAS_PGT_STORAGE_FILE_FORMAT_XML.'\' allowed)');

+      }

+      phpCAS::traceEnd();      

+    }

+

+  // ########################################################################

+  //  INITIALIZATION

+  // ########################################################################

+  

+  /**

+   * This method is used to initialize the storage. Halts on error.

+   *

+   * @public

+   */

+  function init()

+    {

+      phpCAS::traceBegin();

+      // if the storage has already been initialized, return immediatly

+      if ( $this->isInitialized() )

+	return;

+      // call the ancestor's method (mark as initialized)

+      parent::init();

+      phpCAS::traceEnd();      

+    }

+

+  // ########################################################################

+  //  PGT I/O

+  // ########################################################################

+

+  /**

+   * This method returns the filename corresponding to a PGT Iou.

+   *

+   * @param $pgt_iou the PGT iou.

+   *

+   * @return a filename

+   * @private

+   */

+  function getPGTIouFilename($pgt_iou)

+    {

+      phpCAS::traceBegin();

+      $filename = $this->getPath().$pgt_iou.'.'.$this->getFormat();

+      phpCAS::traceEnd($filename);

+      return $filename;

+    }

+  

+  /**

+   * This method stores a PGT and its corresponding PGT Iou into a file. Echoes a

+   * warning on error.

+   *

+   * @param $pgt the PGT

+   * @param $pgt_iou the PGT iou

+   *

+   * @public

+   */

+  function write($pgt,$pgt_iou)

+    {

+      phpCAS::traceBegin();

+      $fname = $this->getPGTIouFilename($pgt_iou);

+      if ( $f=fopen($fname,"w") ) {

+	if ( fputs($f,$pgt) === FALSE ) {

+	  phpCAS::error('could not write PGT to `'.$fname.'\'');

+	}

+	fclose($f);

+      } else {

+	phpCAS::error('could not open `'.$fname.'\'');

+      }

+      phpCAS::traceEnd();      

+    }

+

+  /**

+   * This method reads a PGT corresponding to a PGT Iou and deletes the 

+   * corresponding file.

+   *

+   * @param $pgt_iou the PGT iou

+   *

+   * @return the corresponding PGT, or FALSE on error

+   *

+   * @public

+   */

+  function read($pgt_iou)

+    {

+      phpCAS::traceBegin();

+      $pgt = FALSE;

+      $fname = $this->getPGTIouFilename($pgt_iou);

+      if ( !($f=fopen($fname,"r")) ) {

+	phpCAS::trace('could not open `'.$fname.'\'');

+      } else {

+	if ( ($pgt=fgets($f)) === FALSE ) {

+	  phpCAS::trace('could not read PGT from `'.$fname.'\'');

+	} 

+	fclose($f);

+      }

+

+      // delete the PGT file

+      @unlink($fname);

+

+      phpCAS::traceEnd($pgt);

+      return $pgt;

+    }

+  

+  /** @} */

+  

+}

+

+  

 ?>
\ No newline at end of file
diff --git a/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-main.php b/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-main.php
index 8fd3c9e12..cd9b49967 100644
--- a/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-main.php
+++ b/plugins/CasAuthentication/extlib/CAS/PGTStorage/pgt-main.php
@@ -1,188 +1,188 @@
-<?php
-
-/**
- * @file CAS/PGTStorage/pgt-main.php
- * Basic class for PGT storage
- */
-
-/**
- * @class PGTStorage
- * The PGTStorage class is a generic class for PGT storage. This class should
- * not be instanciated itself but inherited by specific PGT storage classes.
- *
- * @author   Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- *
- * @ingroup internalPGTStorage
- */
-
-class PGTStorage
-{
-  /** 
-   * @addtogroup internalPGTStorage
-   * @{ 
-   */
-
-  // ########################################################################
-  //  CONSTRUCTOR
-  // ########################################################################
-  
-  /**
-   * The constructor of the class, should be called only by inherited classes.
-   *
-   * @param $cas_parent the CASclient instance that creates the current object.
-   *
-   * @protected
-   */
-  function PGTStorage($cas_parent)
-    {
-      phpCAS::traceBegin();
-      if ( !$cas_parent->isProxy() ) {
-	phpCAS::error('defining PGT storage makes no sense when not using a CAS proxy'); 
-      }
-      phpCAS::traceEnd();
-    }
-
-  // ########################################################################
-  //  DEBUGGING
-  // ########################################################################
-  
-  /**
-   * This virtual method returns an informational string giving the type of storage
-   * used by the object (used for debugging purposes).
-   *
-   * @public
-   */
-  function getStorageType()
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  /**
-   * This virtual method returns an informational string giving informations on the
-   * parameters of the storage.(used for debugging purposes).
-   *
-   * @public
-   */
-  function getStorageInfo()
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  // ########################################################################
-  //  ERROR HANDLING
-  // ########################################################################
-  
-  /**
-   * string used to store an error message. Written by PGTStorage::setErrorMessage(),
-   * read by PGTStorage::getErrorMessage().
-   *
-   * @hideinitializer
-   * @private
-   * @deprecated not used.
-   */
-  var $_error_message=FALSE;
-
-  /**
-   * This method sets en error message, which can be read later by 
-   * PGTStorage::getErrorMessage().
-   *
-   * @param $error_message an error message
-   *
-   * @protected
-   * @deprecated not used.
-   */
-  function setErrorMessage($error_message)
-    {
-      $this->_error_message = $error_message;
-    }
-
-  /**
-   * This method returns an error message set by PGTStorage::setErrorMessage().
-   *
-   * @return an error message when set by PGTStorage::setErrorMessage(), FALSE
-   * otherwise.
-   *
-   * @public
-   * @deprecated not used.
-   */
-  function getErrorMessage()
-    {
-      return $this->_error_message;
-    }
-
-  // ########################################################################
-  //  INITIALIZATION
-  // ########################################################################
-
-  /**
-   * a boolean telling if the storage has already been initialized. Written by 
-   * PGTStorage::init(), read by PGTStorage::isInitialized().
-   *
-   * @hideinitializer
-   * @private
-   */
-  var $_initialized = FALSE;
-
-  /**
-   * This method tells if the storage has already been intialized.
-   *
-   * @return a boolean
-   *
-   * @protected
-   */
-  function isInitialized()
-    {
-      return $this->_initialized;
-    }
-
-  /**
-   * This virtual method initializes the object.
-   *
-   * @protected
-   */
-  function init()
-    {
-      $this->_initialized = TRUE;
-    }
-
-  // ########################################################################
-  //  PGT I/O
-  // ########################################################################
-
-  /**
-   * This virtual method stores a PGT and its corresponding PGT Iuo.
-   * @note Should never be called.
-   *
-   * @param $pgt the PGT
-   * @param $pgt_iou the PGT iou
-   *
-   * @protected
-   */
-  function write($pgt,$pgt_iou)
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  /**
-   * This virtual method reads a PGT corresponding to a PGT Iou and deletes
-   * the corresponding storage entry.
-   * @note Should never be called.
-   *
-   * @param $pgt_iou the PGT iou
-   *
-   * @protected
-   */
-  function read($pgt_iou)
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  /** @} */
-  
-} 
-
-// include specific PGT storage classes
-include_once(dirname(__FILE__).'/pgt-file.php'); 
-include_once(dirname(__FILE__).'/pgt-db.php');
-  
+<?php

+

+/**

+ * @file CAS/PGTStorage/pgt-main.php

+ * Basic class for PGT storage

+ */

+

+/**

+ * @class PGTStorage

+ * The PGTStorage class is a generic class for PGT storage. This class should

+ * not be instanciated itself but inherited by specific PGT storage classes.

+ *

+ * @author   Pascal Aubry <pascal.aubry at univ-rennes1.fr>

+ *

+ * @ingroup internalPGTStorage

+ */

+

+class PGTStorage

+{

+  /** 

+   * @addtogroup internalPGTStorage

+   * @{ 

+   */

+

+  // ########################################################################

+  //  CONSTRUCTOR

+  // ########################################################################

+  

+  /**

+   * The constructor of the class, should be called only by inherited classes.

+   *

+   * @param $cas_parent the CASclient instance that creates the current object.

+   *

+   * @protected

+   */

+  function PGTStorage($cas_parent)

+    {

+      phpCAS::traceBegin();

+      if ( !$cas_parent->isProxy() ) {

+	phpCAS::error('defining PGT storage makes no sense when not using a CAS proxy'); 

+      }

+      phpCAS::traceEnd();

+    }

+

+  // ########################################################################

+  //  DEBUGGING

+  // ########################################################################

+  

+  /**

+   * This virtual method returns an informational string giving the type of storage

+   * used by the object (used for debugging purposes).

+   *

+   * @public

+   */

+  function getStorageType()

+    {

+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 

+    }

+

+  /**

+   * This virtual method returns an informational string giving informations on the

+   * parameters of the storage.(used for debugging purposes).

+   *

+   * @public

+   */

+  function getStorageInfo()

+    {

+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 

+    }

+

+  // ########################################################################

+  //  ERROR HANDLING

+  // ########################################################################

+  

+  /**

+   * string used to store an error message. Written by PGTStorage::setErrorMessage(),

+   * read by PGTStorage::getErrorMessage().

+   *

+   * @hideinitializer

+   * @private

+   * @deprecated not used.

+   */

+  var $_error_message=FALSE;

+

+  /**

+   * This method sets en error message, which can be read later by 

+   * PGTStorage::getErrorMessage().

+   *

+   * @param $error_message an error message

+   *

+   * @protected

+   * @deprecated not used.

+   */

+  function setErrorMessage($error_message)

+    {

+      $this->_error_message = $error_message;

+    }

+

+  /**

+   * This method returns an error message set by PGTStorage::setErrorMessage().

+   *

+   * @return an error message when set by PGTStorage::setErrorMessage(), FALSE

+   * otherwise.

+   *

+   * @public

+   * @deprecated not used.

+   */

+  function getErrorMessage()

+    {

+      return $this->_error_message;

+    }

+

+  // ########################################################################

+  //  INITIALIZATION

+  // ########################################################################

+

+  /**

+   * a boolean telling if the storage has already been initialized. Written by 

+   * PGTStorage::init(), read by PGTStorage::isInitialized().

+   *

+   * @hideinitializer

+   * @private

+   */

+  var $_initialized = FALSE;

+

+  /**

+   * This method tells if the storage has already been intialized.

+   *

+   * @return a boolean

+   *

+   * @protected

+   */

+  function isInitialized()

+    {

+      return $this->_initialized;

+    }

+

+  /**

+   * This virtual method initializes the object.

+   *

+   * @protected

+   */

+  function init()

+    {

+      $this->_initialized = TRUE;

+    }

+

+  // ########################################################################

+  //  PGT I/O

+  // ########################################################################

+

+  /**

+   * This virtual method stores a PGT and its corresponding PGT Iuo.

+   * @note Should never be called.

+   *

+   * @param $pgt the PGT

+   * @param $pgt_iou the PGT iou

+   *

+   * @protected

+   */

+  function write($pgt,$pgt_iou)

+    {

+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 

+    }

+

+  /**

+   * This virtual method reads a PGT corresponding to a PGT Iou and deletes

+   * the corresponding storage entry.

+   * @note Should never be called.

+   *

+   * @param $pgt_iou the PGT iou

+   *

+   * @protected

+   */

+  function read($pgt_iou)

+    {

+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 

+    }

+

+  /** @} */

+  

+} 

+

+// include specific PGT storage classes

+include_once(dirname(__FILE__).'/pgt-file.php'); 

+include_once(dirname(__FILE__).'/pgt-db.php');

+  

 ?>
\ No newline at end of file
diff --git a/plugins/CasAuthentication/extlib/CAS/client.php b/plugins/CasAuthentication/extlib/CAS/client.php
index bbde55a28..ad5a23f83 100644
--- a/plugins/CasAuthentication/extlib/CAS/client.php
+++ b/plugins/CasAuthentication/extlib/CAS/client.php
@@ -351,6 +351,43 @@ class CASClient
 		{
 		return $this->_server['login_url'] = $url;
 		}
+		
+		
+	/**
+	 * This method sets the serviceValidate URL of the CAS server.
+	 * @param $url the serviceValidate URL
+	 * @private
+	 * @since 1.1.0 by Joachim Fritschi
+	 */
+	function setServerServiceValidateURL($url)
+		{
+		return $this->_server['service_validate_url'] = $url;
+		}
+		
+		
+	/**
+	 * This method sets the proxyValidate URL of the CAS server.
+	 * @param $url the proxyValidate URL
+	 * @private
+	 * @since 1.1.0 by Joachim Fritschi
+	 */
+	function setServerProxyValidateURL($url)
+		{
+		return $this->_server['proxy_validate_url'] = $url;
+		}
+		
+		
+	/**
+	 * This method sets the samlValidate URL of the CAS server.
+	 * @param $url the samlValidate URL
+	 * @private
+	 * @since 1.1.0 by Joachim Fritschi
+	 */
+	function setServerSamlValidateURL($url)
+		{
+		return $this->_server['saml_validate_url'] = $url;
+		}
+			
 	
 	/**
 	 * This method is used to retrieve the service validating URL of the CAS server.
@@ -373,7 +410,25 @@ class CASClient
 		//      return $this->_server['service_validate_url'].'?service='.preg_replace('/&/','%26',$this->getURL()); 
 		return $this->_server['service_validate_url'].'?service='.urlencode($this->getURL()); 
 		}
-	
+	/**
+	* This method is used to retrieve the SAML validating URL of the CAS server.
+	* @return a URL.
+	* @private
+	*/
+	function getServerSamlValidateURL()
+	{
+	phpCAS::traceBegin();
+	// the URL is build only when needed
+	if ( empty($this->_server['saml_validate_url']) ) {
+		switch ($this->getServerVersion()) {
+		case SAML_VERSION_1_1:
+			$this->_server['saml_validate_url'] = $this->getServerBaseURL().'samlValidate';
+			break;
+			}
+	}
+	phpCAS::traceEnd($this->_server['saml_validate_url'].'?TARGET='.urlencode($this->getURL()));
+	return $this->_server['saml_validate_url'].'?TARGET='.urlencode($this->getURL());
+	}
 	/**
 	 * This method is used to retrieve the proxy validating URL of the CAS server.
 	 * @return a URL.
@@ -497,31 +552,51 @@ class CASClient
 		
 		phpCAS::traceBegin();
 		
-		if (!$this->isLogoutRequest() && !empty($_GET['ticket']) && $start_session) {
-            // copy old session vars and destroy the current session
-            if (!isset($_SESSION)) {
-            	session_start();
-            }
-            $old_session = $_SESSION;
-            session_destroy();
-            // set up a new session, of name based on the ticket
-			$session_id = preg_replace('/[^\w]/','',$_GET['ticket']);
-			phpCAS::LOG("Session ID: " . $session_id);
-			session_id($session_id);
-            if (!isset($_SESSION)) {
-            	session_start();
-            }
-            // restore old session vars
-            $_SESSION = $old_session;
-            // Redirect to location without ticket.
-            header('Location: '.$this->getURL());
-		}
-		
-		//activate session mechanism if desired
-		if (!$this->isLogoutRequest() && $start_session) {
-			session_start();
+		// the redirect header() call and DOM parsing code from domxml-php4-php5.php won't work in PHP4 compatibility mode
+		if (version_compare(PHP_VERSION,'5','>=') && ini_get('zend.ze1_compatibility_mode')) {
+			phpCAS::error('phpCAS cannot support zend.ze1_compatibility_mode. Sorry.');
+		}
+		// skip Session Handling for logout requests and if don't want it'
+		if ($start_session && !$this->isLogoutRequest()) {
+			phpCAS::trace("Starting session handling");
+			// Check for Tickets from the CAS server
+			if (empty($_GET['ticket'])){
+				phpCAS::trace("No ticket found");
+				// only create a session if necessary
+				if (!isset($_SESSION)) {
+					phpCAS::trace("No session found, creating new session");
+					session_start();
+				}
+			}else{
+				phpCAS::trace("Ticket found");
+				// We have to copy any old data before renaming the session
+				if (isset($_SESSION)) {
+					phpCAS::trace("Old active session found, saving old data and destroying session");
+					$old_session = $_SESSION;
+					session_destroy();	
+				}else{
+					session_start();
+					phpCAS::trace("Starting possible old session to copy variables");
+					$old_session = $_SESSION;
+					session_destroy();	
+				}
+				// set up a new session, of name based on the ticket
+				$session_id = preg_replace('/[^\w]/','',$_GET['ticket']);
+				phpCAS::LOG("Session ID: " . $session_id);
+				session_id($session_id);
+				session_start();
+				// restore old session vars
+				if(isset($old_session)){
+					phpCAS::trace("Restoring old session vars");
+					$_SESSION = $old_session;
+				}
+			}
+		}else{
+			phpCAS::trace("Skipping session creation");
 		}
+
 		
+		// are we in proxy mode ?
 		$this->_proxy = $proxy;
 		
 		//check version
@@ -533,6 +608,8 @@ class CASClient
 				break;
 			case CAS_VERSION_2_0:
 				break;
+			case SAML_VERSION_1_1:
+				break;
 			default:
 				phpCAS::error('this version of CAS (`'
 					.$server_version
@@ -541,29 +618,29 @@ class CASClient
 		}
 		$this->_server['version'] = $server_version;
 		
-		//check hostname
+		// check hostname
 		if ( empty($server_hostname) 
 				|| !preg_match('/[\.\d\-abcdefghijklmnopqrstuvwxyz]*/',$server_hostname) ) {
 			phpCAS::error('bad CAS server hostname (`'.$server_hostname.'\')');
 		}
 		$this->_server['hostname'] = $server_hostname;
 		
-		//check port
+		// check port
 		if ( $server_port == 0 
 			|| !is_int($server_port) ) {
 			phpCAS::error('bad CAS server port (`'.$server_hostname.'\')');
 		}
 		$this->_server['port'] = $server_port;
 		
-		//check URI
+		// check URI
 		if ( !preg_match('/[\.\d\-_abcdefghijklmnopqrstuvwxyz\/]*/',$server_uri) ) {
 			phpCAS::error('bad CAS server URI (`'.$server_uri.'\')');
 		}
-		//add leading and trailing `/' and remove doubles      
+		// add leading and trailing `/' and remove doubles      
 		$server_uri = preg_replace('/\/\//','/','/'.$server_uri.'/');
 		$this->_server['uri'] = $server_uri;
 		
-		//set to callback mode if PgtIou and PgtId CGI GET parameters are provided 
+		// set to callback mode if PgtIou and PgtId CGI GET parameters are provided 
 		if ( $this->isProxy() ) {
 			$this->setCallbackMode(!empty($_GET['pgtIou'])&&!empty($_GET['pgtId']));
 		}
@@ -590,8 +667,12 @@ class CASClient
 					}
 					break;
 				case CAS_VERSION_2_0: // check for a Service or Proxy Ticket
-					if( preg_match('/^[SP]T-/',$ticket) ) {
-						phpCAS::trace('ST or PT \''.$ticket.'\' found');
+					if (preg_match('/^ST-/', $ticket)) {
+						phpCAS::trace('ST \'' . $ticket . '\' found');
+						$this->setST($ticket);
+						unset ($_GET['ticket']);
+					} else if (preg_match('/^PT-/', $ticket)) {
+						phpCAS::trace('PT \'' . $ticket . '\' found');
 						$this->setPT($ticket);
 						unset($_GET['ticket']);
 					} else if ( !empty($ticket) ) {
@@ -599,6 +680,16 @@ class CASClient
 						phpCAS::error('ill-formed ticket found in the URL (ticket=`'.htmlentities($ticket).'\')');
 					} 
 					break;
+				case SAML_VERSION_1_1: // SAML just does Service Tickets
+					if( preg_match('/^[SP]T-/',$ticket) ) {
+					phpCAS::trace('SA \''.$ticket.'\' found');
+					$this->setSA($ticket);
+					unset($_GET['ticket']);
+					} else if ( !empty($ticket) ) {
+						//ill-formed ticket, halt
+						phpCAS::error('ill-formed ticket found in the URL (ticket=`'.htmlentities($ticket).'\')');
+					}
+					break;
 			}
 		}
 		phpCAS::traceEnd();
@@ -652,6 +743,45 @@ class CASClient
 		}
 		return $this->_user;
 		}
+
+
+	
+	/***********************************************************************************************************************
+	 * Atrributes section
+	 * 
+	 * @author Matthias Crauwels <matthias.crauwels@ugent.be>, Ghent University, Belgium
+	 * 
+	 ***********************************************************************************************************************/
+	/**
+	 * The Authenticated users attributes. Written by CASClient::setAttributes(), read by CASClient::getAttributes().
+	 * @attention client applications should use phpCAS::getAttributes().
+	 *
+	 * @hideinitializer
+	 * @private
+	 */	
+	var $_attributes = array();
+
+	function setAttributes($attributes)	
+		{ $this->_attributes = $attributes; }
+		
+	function getAttributes() {
+		if ( empty($this->_user) ) { // if no user is set, there shouldn't be any attributes also...
+			phpCAS::error('this method should be used only after '.__CLASS__.'::forceAuthentication() or '.__CLASS__.'::isAuthenticated()');
+		}
+		return $this->_attributes;
+	}
+		
+	function hasAttributes()
+		{ return !empty($this->_attributes); }
+		
+	function hasAttribute($key)
+		{ return (is_array($this->_attributes) && array_key_exists($key, $this->_attributes)); }
+		
+	function getAttribute($key)	{
+		if($this->hasAttribute($key)) {
+			return $this->_attributes[$key];
+		}
+	}
 	
 	/**
 	 * This method is called to renew the authentication of the user
@@ -778,55 +908,72 @@ class CASClient
 	 * This method is called to check if the user is authenticated (previously or by
 	 * tickets given in the URL).
 	 *
-	 * @return TRUE when the user is authenticated.
+	 * @return TRUE when the user is authenticated. Also may redirect to the same URL without the ticket.
 	 *
 	 * @public
 	 */
 	function isAuthenticated()
 		{
-		phpCAS::traceBegin();
-		$res = FALSE;
-		$validate_url = '';
-		
-		if ( $this->wasPreviouslyAuthenticated() ) {
-			// the user has already (previously during the session) been 
-			// authenticated, nothing to be done.
-			phpCAS::trace('user was already authenticated, no need to look for tickets');
-			$res = TRUE;
-		} 
-		elseif ( $this->hasST() ) {
-			// if a Service Ticket was given, validate it
-			phpCAS::trace('ST `'.$this->getST().'\' is present');
-			$this->validateST($validate_url,$text_response,$tree_response); // if it fails, it halts
-			phpCAS::trace('ST `'.$this->getST().'\' was validated');
-			if ( $this->isProxy() ) {
-				$this->validatePGT($validate_url,$text_response,$tree_response); // idem
-				phpCAS::trace('PGT `'.$this->getPGT().'\' was validated');
-				$_SESSION['phpCAS']['pgt'] = $this->getPGT();
+			phpCAS::traceBegin();
+			$res = FALSE;
+			$validate_url = '';
+
+			if ( $this->wasPreviouslyAuthenticated() ) {
+				// the user has already (previously during the session) been
+				// authenticated, nothing to be done.
+				phpCAS::trace('user was already authenticated, no need to look for tickets');
+				$res = TRUE;
 			}
-			$_SESSION['phpCAS']['user'] = $this->getUser();
-			$res = TRUE;
-		}
-		elseif ( $this->hasPT() ) {
-			// if a Proxy Ticket was given, validate it
-			phpCAS::trace('PT `'.$this->getPT().'\' is present');
-			$this->validatePT($validate_url,$text_response,$tree_response); // note: if it fails, it halts
-			phpCAS::trace('PT `'.$this->getPT().'\' was validated');
-			if ( $this->isProxy() ) {
-				$this->validatePGT($validate_url,$text_response,$tree_response); // idem
-				phpCAS::trace('PGT `'.$this->getPGT().'\' was validated');
-				$_SESSION['phpCAS']['pgt'] = $this->getPGT();
+			else {
+				if ( $this->hasST() ) {
+					// if a Service Ticket was given, validate it
+					phpCAS::trace('ST `'.$this->getST().'\' is present');
+					$this->validateST($validate_url,$text_response,$tree_response); // if it fails, it halts
+					phpCAS::trace('ST `'.$this->getST().'\' was validated');
+					if ( $this->isProxy() ) {
+						$this->validatePGT($validate_url,$text_response,$tree_response); // idem
+						phpCAS::trace('PGT `'.$this->getPGT().'\' was validated');
+						$_SESSION['phpCAS']['pgt'] = $this->getPGT();
+					}
+					$_SESSION['phpCAS']['user'] = $this->getUser();
+					$res = TRUE;
+				}
+				elseif ( $this->hasPT() ) {
+					// if a Proxy Ticket was given, validate it
+					phpCAS::trace('PT `'.$this->getPT().'\' is present');
+					$this->validatePT($validate_url,$text_response,$tree_response); // note: if it fails, it halts
+					phpCAS::trace('PT `'.$this->getPT().'\' was validated');
+					if ( $this->isProxy() ) {
+						$this->validatePGT($validate_url,$text_response,$tree_response); // idem
+						phpCAS::trace('PGT `'.$this->getPGT().'\' was validated');
+						$_SESSION['phpCAS']['pgt'] = $this->getPGT();
+					}
+					$_SESSION['phpCAS']['user'] = $this->getUser();
+					$res = TRUE;
+				}
+				elseif ( $this->hasSA() ) {
+					// if we have a SAML ticket, validate it.
+					phpCAS::trace('SA `'.$this->getSA().'\' is present');
+					$this->validateSA($validate_url,$text_response,$tree_response); // if it fails, it halts
+					phpCAS::trace('SA `'.$this->getSA().'\' was validated');
+					$_SESSION['phpCAS']['user'] = $this->getUser();
+					$_SESSION['phpCAS']['attributes'] = $this->getAttributes();
+					$res = TRUE;
+				}
+				else {
+					// no ticket given, not authenticated
+					phpCAS::trace('no ticket found');
+				}
+				if ($res) {
+					// if called with a ticket parameter, we need to redirect to the app without the ticket so that CAS-ification is transparent to the browser (for later POSTS)
+					// most of the checks and errors should have been made now, so we're safe for redirect without masking error messages.
+					header('Location: '.$this->getURL());
+					phpCAS::log( "Prepare redirect to : ".$this->getURL() );
+				}
 			}
-			$_SESSION['phpCAS']['user'] = $this->getUser();
-			$res = TRUE;
-		} 
-		else {
-			// no ticket given, not authenticated
-			phpCAS::trace('no ticket found');
-		}
-		
-		phpCAS::traceEnd($res);
-		return $res;
+
+			phpCAS::traceEnd($res);
+			return $res;
 		}
 	
 	/**
@@ -889,6 +1036,9 @@ class CASClient
 			if ( $this->isSessionAuthenticated() ) {
 				// authentication already done
 				$this->setUser($_SESSION['phpCAS']['user']);
+				if(isset($_SESSION['phpCAS']['attributes'])){
+					$this->setAttributes($_SESSION['phpCAS']['attributes']);
+				}
 				phpCAS::trace('user = `'.$_SESSION['phpCAS']['user'].'\''); 
 				$auth = TRUE;
 			} else {
@@ -917,6 +1067,7 @@ class CASClient
 		
 		printf('<p>'.$this->getString(CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED).'</p>',$cas_url);
 		$this->printHTMLFooter();
+		
 		phpCAS::traceExit();
 		exit();
 	}
@@ -962,11 +1113,15 @@ class CASClient
 			$cas_url = $cas_url . $paramSeparator . "service=" . urlencode($params['service']); 
 		}
 		header('Location: '.$cas_url);
+		phpCAS::log( "Prepare redirect to : ".$cas_url );
+ 
 		session_unset();
 		session_destroy();
+		
 		$this->printHTMLHeader($this->getString(CAS_STR_LOGOUT));
 		printf('<p>'.$this->getString(CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED).'</p>',$cas_url);
 		$this->printHTMLFooter();
+		
 		phpCAS::traceExit();
 		exit();
 	}
@@ -1009,10 +1164,10 @@ class CASClient
 			}
 			$client_ip = $_SERVER['REMOTE_ADDR'];
 			$client = gethostbyaddr($client_ip);
-			phpCAS::log("Client: ".$client);
+			phpCAS::log("Client: ".$client."/".$client_ip); 
 			$allowed = false;
 			foreach ($allowed_clients as $allowed_client) {
-				if ($client == $allowed_client) {
+				if (($client == $allowed_client) or ($client_ip == $allowed_client)) { 
 					phpCAS::log("Allowed client '".$allowed_client."' matches, logout request is allowed");
 					$allowed = true;
 					break;
@@ -1284,6 +1439,151 @@ class CASClient
 		phpCAS::traceEnd(TRUE);
 		return TRUE;
 		}
+
+ // ########################################################################
+ //  SAML VALIDATION
+ // ########################################################################
+   /**
+    * @addtogroup internalBasic
+    * @{
+    */
+
+   /**
+    * This method is used to validate a SAML TICKET; halt on failure, and sets $validate_url,
+    * $text_reponse and $tree_response on success. These parameters are used later
+    * by CASClient::validatePGT() for CAS proxies.
+    *
+    * @param $validate_url the URL of the request to the CAS server.
+    * @param $text_response the response of the CAS server, as is (XML text).
+    * @param $tree_response the response of the CAS server, as a DOM XML tree.
+    *
+    * @return bool TRUE when successfull, halt otherwise by calling CASClient::authError().
+    *
+    * @private
+    */
+   function validateSA($validate_url,&$text_response,&$tree_response)
+     {
+       phpCAS::traceBegin();
+
+       // build the URL to validate the ticket
+       $validate_url = $this->getServerSamlValidateURL();
+
+       // open and read the URL
+       if ( !$this->readURL($validate_url,''/*cookies*/,$headers,$text_response,$err_msg) ) {
+           phpCAS::trace('could not open URL \''.$validate_url.'\' to validate ('.$err_msg.')');
+           $this->authError('SA not validated', $validate_url, TRUE/*$no_response*/);
+       }
+
+       phpCAS::trace('server version: '.$this->getServerVersion());
+
+       // analyze the result depending on the version
+       switch ($this->getServerVersion()) {
+       case SAML_VERSION_1_1:
+
+     // read the response of the CAS server into a DOM object
+       if ( !($dom = domxml_open_mem($text_response))) {
+         phpCAS::trace('domxml_open_mem() failed');
+         $this->authError('SA not validated',
+                      $validate_url,
+                      FALSE/*$no_response*/,
+                      TRUE/*$bad_response*/,
+                      $text_response);
+       }
+       // read the root node of the XML tree
+       if ( !($tree_response = $dom->document_element()) ) {
+         phpCAS::trace('document_element() failed');
+         $this->authError('SA not validated',
+                      $validate_url,
+                      FALSE/*$no_response*/,
+                      TRUE/*$bad_response*/,
+                      $text_response);
+       }
+       // insure that tag name is 'Envelope'
+       if ( $tree_response->node_name() != 'Envelope' ) {
+         phpCAS::trace('bad XML root node (should be `Envelope\' instead of `'.$tree_response->node_name().'\'');
+         $this->authError('SA not validated',
+                      $validate_url,
+                      FALSE/*$no_response*/,
+                      TRUE/*$bad_response*/,
+                      $text_response);
+       }
+     // check for the NameIdentifier tag in the SAML response
+       if ( sizeof($success_elements = $tree_response->get_elements_by_tagname("NameIdentifier")) != 0) {
+       phpCAS::trace('NameIdentifier found');
+         $user = trim($success_elements[0]->get_content());
+         phpCAS::trace('user = `'.$user.'`');
+         $this->setUser($user);
+       $this->setSessionAttributes($text_response);
+       } else {
+         phpCAS::trace('no <NameIdentifier> tag found in SAML payload');
+         $this->authError('SA not validated',
+                      $validate_url,
+                      FALSE/*$no_response*/,
+                      TRUE/*$bad_response*/,
+                      $text_response);
+       }
+       break;
+       }
+
+       // at this step, ST has been validated and $this->_user has been set,
+       phpCAS::traceEnd(TRUE);
+       return TRUE;
+     }
+
+   /**
+    * This method will parse the DOM and pull out the attributes from the SAML
+    * payload and put them into an array, then put the array into the session.
+    *
+    * @param $text_response the SAML payload.
+    * @return bool TRUE when successfull, halt otherwise by calling CASClient::authError().
+    *
+    * @private
+    */
+ function setSessionAttributes($text_response)
+ {
+           phpCAS::traceBegin();
+
+           $result = FALSE;
+
+           if (isset($_SESSION[SAML_ATTRIBUTES])) {
+             phpCAS::trace("session attrs already set.");  //testbml - do we care?
+           }
+
+           $attr_array = array();
+
+                if (($dom = domxml_open_mem($text_response))) {
+                   $xPath = $dom->xpath_new_context();
+                   $xPath->xpath_register_ns('samlp', 'urn:oasis:names:tc:SAML:1.0:protocol');
+                   $xPath->xpath_register_ns('saml', 'urn:oasis:names:tc:SAML:1.0:assertion');
+                   $nodelist = $xPath->xpath_eval("//saml:Attribute");
+                   $attrs = $nodelist->nodeset;
+                   phpCAS::trace($text_response);
+                  foreach($attrs as $attr){
+                      $xres = $xPath->xpath_eval("saml:AttributeValue", $attr);
+                      $name = $attr->get_attribute("AttributeName");
+                      $value_array = array();
+                      foreach($xres->nodeset as $node){
+                          $value_array[] = $node->get_content();
+                         
+                      }
+                      phpCAS::trace("* " . $name . "=" . $value_array);
+                      $attr_array[$name] = $value_array;
+                   }
+                   $_SESSION[SAML_ATTRIBUTES] = $attr_array;
+		   // UGent addition...
+		   foreach($attr_array as $attr_key => $attr_value) {
+		      if(count($attr_value) > 1) {
+			$this->_attributes[$attr_key] = $attr_value;
+		      }
+		      else {
+			$this->_attributes[$attr_key] = $attr_value[0];
+		      }
+		   }
+                   $result = TRUE;
+                }
+       phpCAS::traceEnd($result);
+       return $result;
+ }
 	
 	/** @} */
 	
@@ -1495,6 +1795,7 @@ class CASClient
 		$this->storePGT($pgt,$pgt_iou);
 		$this->printHTMLFooter();
 		phpCAS::traceExit();
+		exit();
 		}
 	
 	/** @} */
@@ -1585,7 +1886,7 @@ class CASClient
 		}
 		
 		// create the storage object
-		$this->_pgt_storage = &new PGTStorageFile($this,$format,$path);
+		$this->_pgt_storage = new PGTStorageFile($this,$format,$path);
 		}
 	
 	/**
@@ -1622,7 +1923,7 @@ class CASClient
 		trigger_error('PGT storage into database is an experimental feature, use at your own risk',E_USER_WARNING);
 		
 		// create the storage object
-		$this->_pgt_storage = & new PGTStorageDB($this,$user,$password,$database_type,$hostname,$port,$database,$table);
+		$this->_pgt_storage = new PGTStorageDB($this,$user,$password,$database_type,$hostname,$port,$database,$table);
 		}
 	
 	// ########################################################################
@@ -1643,7 +1944,8 @@ class CASClient
 	 */
 	function validatePGT(&$validate_url,$text_response,$tree_response)
 		{
-		phpCAS::traceBegin();
+		// here cannot use phpCAS::traceBegin(); alongside domxml-php4-to-php5.php
+		phpCAS::log('start validatePGT()');
 		if ( sizeof($arr = $tree_response->get_elements_by_tagname("proxyGrantingTicket")) == 0) {
 			phpCAS::trace('<proxyGrantingTicket> not found');
 			// authentication succeded, but no PGT Iou was transmitted
@@ -1666,7 +1968,8 @@ class CASClient
 			}
 			$this->setPGT($pgt);
 		}
-		phpCAS::traceEnd(TRUE);
+		// here, cannot use	phpCAS::traceEnd(TRUE); alongside domxml-php4-to-php5.php
+		phpCAS::log('end validatePGT()');
 		return TRUE;
 		}
 	
@@ -1819,7 +2122,15 @@ class CASClient
 		if ($this->_cas_server_cert == '' && $this->_cas_server_ca_cert == '' && !$this->_no_cas_server_validation) {
 			phpCAS::error('one of the methods phpCAS::setCasServerCert(), phpCAS::setCasServerCACert() or phpCAS::setNoCasServerValidation() must be called.');
 		}
-		if ($this->_cas_server_cert != '' ) {
+		if ($this->_cas_server_cert != '' && $this->_cas_server_ca_cert != '') {
+			// This branch added by IDMS. Seems phpCAS implementor got a bit confused about the curl options CURLOPT_SSLCERT and CURLOPT_CAINFO
+			curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
+			curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 1);
+			curl_setopt($ch, CURLOPT_SSLCERT, $this->_cas_server_cert);
+			curl_setopt($ch, CURLOPT_CAINFO, $this->_cas_server_ca_cert);
+			curl_setopt($ch, CURLOPT_VERBOSE, '1');
+			phpCAS::trace('CURL: Set all required opts for mutual authentication ------');
+		} else if ($this->_cas_server_cert != '' ) {
 			curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
 			curl_setopt($ch, CURLOPT_SSLCERT, $this->_cas_server_cert);
 		} else if ($this->_cas_server_ca_cert != '') {
@@ -1839,11 +2150,28 @@ class CASClient
 		if ( is_array($cookies) ) {
 			curl_setopt($ch,CURLOPT_COOKIE,implode(';',$cookies));
 		}
+                // add extra stuff if SAML
+                if ($this->hasSA()) {
+                        $more_headers = array ("soapaction: http://www.oasis-open.org/committees/security",
+                                               "cache-control: no-cache",
+                                               "pragma: no-cache",
+                                               "accept: text/xml",
+                                               "connection: keep-alive",
+                                               "content-type: text/xml");
+
+                       curl_setopt($ch, CURLOPT_HTTPHEADER, $more_headers);
+                       curl_setopt($ch, CURLOPT_POST, 1);
+                       $data = $this->buildSAMLPayload();
+                       //phpCAS::trace('SAML Payload: '.print_r($data, TRUE));
+                       curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
+                }
 		// perform the query
 		$buf = curl_exec ($ch);
+		//phpCAS::trace('CURL: Call completed. Response body is: \''.$buf.'\'');
 		if ( $buf === FALSE ) {
 			phpCAS::trace('curl_exec() failed');
 			$err_msg = 'CURL error #'.curl_errno($ch).': '.curl_error($ch);
+			//phpCAS::trace('curl error: '.$err_msg);
 			// close the CURL session
 			curl_close ($ch);
 			$res = FALSE;
@@ -1858,7 +2186,28 @@ class CASClient
 		phpCAS::traceEnd($res);
 		return $res;
 	}
-	
+
+        /**
+        * This method is used to build the SAML POST body sent to /samlValidate URL.
+        *
+        * @return the SOAP-encased SAMLP artifact (the ticket).
+        *
+        * @private
+        */
+        function buildSAMLPayload()
+        {
+        phpCAS::traceBegin();
+
+        //get the ticket
+        $sa = $this->getSA();
+        //phpCAS::trace("SA: ".$sa);
+
+        $body=SAML_SOAP_ENV.SAML_SOAP_BODY.SAMLP_REQUEST.SAML_ASSERTION_ARTIFACT.$sa.SAML_ASSERTION_ARTIFACT_CLOSE.SAMLP_REQUEST_CLOSE.SAML_SOAP_BODY_CLOSE.SAML_SOAP_ENV_CLOSE;
+
+        phpCAS::traceEnd($body);
+        return ($body);
+        }
+
 	/**
 	 * This method is the callback used by readURL method to request HTTP headers.
 	 */
@@ -1951,6 +2300,7 @@ class CASClient
 	 * 
 	 * @param $url a string giving the URL of the service, including the mailing box
 	 * for IMAP URLs, as accepted by imap_open().
+	 * @param $service a string giving for CAS retrieve Proxy ticket
 	 * @param $flags options given to imap_open().
 	 * @param $err_code an error code Possible values are PHPCAS_SERVICE_OK (on
 	 * success), PHPCAS_SERVICE_PT_NO_SERVER_RESPONSE, PHPCAS_SERVICE_PT_BAD_SERVER_RESPONSE,
@@ -1964,11 +2314,11 @@ class CASClient
 	 *
 	 * @public
 	 */
-	function serviceMail($url,$flags,&$err_code,&$err_msg,&$pt)
+	function serviceMail($url,$service,$flags,&$err_code,&$err_msg,&$pt)
 		{
 		phpCAS::traceBegin();
 		// at first retrieve a PT
-		$pt = $this->retrievePT($target_service,$err_code,$output);
+		$pt = $this->retrievePT($service,$err_code,$output);
 		
 		$stream = FALSE;
 		
@@ -2049,7 +2399,30 @@ class CASClient
 	 */
 	function hasPT()
 		{ return !empty($this->_pt); }
-	
+	/**
+       * This method returns the SAML Ticket provided in the URL of the request.
+       * @return The SAML ticket.
+       * @private
+       */
+       function getSA()
+       { return 'ST'.substr($this->_sa, 2); }
+
+       /**
+       * This method stores the SAML Ticket.
+       * @param $sa The SAML Ticket.
+       * @private
+       */
+       function setSA($sa)
+       { $this->_sa = $sa; }
+
+       /**
+       * This method tells if a SAML Ticket was stored.
+       * @return TRUE if a SAML Ticket has been stored.
+       * @private
+       */
+       function hasSA()
+       { return !empty($this->_sa); }
+
 	/** @} */
 	// ########################################################################
 	//  PT VALIDATION
@@ -2213,8 +2586,13 @@ class CASClient
 				}
 			}
 			
-			$final_uri .= strtok($_SERVER['REQUEST_URI'],"?");
-			$cgi_params = '?'.strtok("?");
+			$php_is_for_sissies = split("\?", $_SERVER['REQUEST_URI'], 2);
+			$final_uri .= $php_is_for_sissies[0];
+			if(sizeof($php_is_for_sissies) > 1){
+				$cgi_params = '?' . $php_is_for_sissies[1];
+			} else {
+				$cgi_params = '?';
+			}
 			// remove the ticket if present in the CGI parameters
 			$cgi_params = preg_replace('/&ticket=[^&]*/','',$cgi_params);
 			$cgi_params = preg_replace('/\?ticket=[^&;]*/','?',$cgi_params);
@@ -2294,4 +2672,4 @@ class CASClient
 	/** @} */
 }
 
-?>
\ No newline at end of file
+?>
diff --git a/plugins/CasAuthentication/extlib/CAS/domxml-php4-php5.php b/plugins/CasAuthentication/extlib/CAS/domxml-php4-php5.php
deleted file mode 100644
index a0dfb99c7..000000000
--- a/plugins/CasAuthentication/extlib/CAS/domxml-php4-php5.php
+++ /dev/null
@@ -1,277 +0,0 @@
-<?php
-/**
- * @file domxml-php4-php5.php
- * Require PHP5, uses built-in DOM extension.
- * To be used in PHP4 scripts using DOMXML extension.
- * Allows PHP4/DOMXML scripts to run on PHP5/DOM.
- * (Requires PHP5/XSL extension for domxml_xslt functions)
- *
- * Typical use:
- * <pre>
- * {
- *  if (version_compare(PHP_VERSION,'5','>='))
- *   require_once('domxml-php4-to-php5.php');
- * }
- * </pre>
- *
- * Version 1.5.5, 2005-01-18, http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
- *
- * ------------------------------------------------------------------<br>
- * Written by Alexandre Alapetite, http://alexandre.alapetite.net/cv/
- *
- * Copyright 2004, Licence: Creative Commons "Attribution-ShareAlike 2.0 France" BY-SA (FR),
- * http://creativecommons.org/licenses/by-sa/2.0/fr/
- * http://alexandre.alapetite.net/divers/apropos/#by-sa
- * - Attribution. You must give the original author credit
- * - Share Alike. If you alter, transform, or build upon this work,
- *   you may distribute the resulting work only under a license identical to this one
- * - The French law is authoritative
- * - Any of these conditions can be waived if you get permission from Alexandre Alapetite
- * - Please send to Alexandre Alapetite the modifications you make,
- *   in order to improve this file for the benefit of everybody
- *
- * If you want to distribute this code, please do it as a link to:
- * http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
- */
-
-function domxml_new_doc($version) {return new php4DOMDocument('');}
-function domxml_open_file($filename) {return new php4DOMDocument($filename);}
-function domxml_open_mem($str)
-{
- $dom=new php4DOMDocument('');
- $dom->myDOMNode->loadXML($str);
- return $dom;
-}
-function xpath_eval($xpath_context,$eval_str,$contextnode=null) {return $xpath_context->query($eval_str,$contextnode);}
-function xpath_new_context($dom_document) {return new php4DOMXPath($dom_document);}
-
-class php4DOMAttr extends php4DOMNode
-{
- function php4DOMAttr($aDOMAttr) {$this->myDOMNode=$aDOMAttr;}
- function Name() {return $this->myDOMNode->name;}
- function Specified() {return $this->myDOMNode->specified;}
- function Value() {return $this->myDOMNode->value;}
-}
-
-class php4DOMDocument extends php4DOMNode
-{
- function php4DOMDocument($filename='')
- {
-  $this->myDOMNode=new DOMDocument();
-  if ($filename!='') $this->myDOMNode->load($filename);
- }
- function create_attribute($name,$value)
- {
-  $myAttr=$this->myDOMNode->createAttribute($name);
-  $myAttr->value=$value;
-  return new php4DOMAttr($myAttr,$this);
- }
- function create_cdata_section($content) {return new php4DOMNode($this->myDOMNode->createCDATASection($content),$this);}
- function create_comment($data) {return new php4DOMNode($this->myDOMNode->createComment($data),$this);}
- function create_element($name) {return new php4DOMElement($this->myDOMNode->createElement($name),$this);}
- function create_text_node($content) {return new php4DOMNode($this->myDOMNode->createTextNode($content),$this);}
- function document_element() {return new php4DOMElement($this->myDOMNode->documentElement,$this);}
- function dump_file($filename,$compressionmode=false,$format=false) {return $this->myDOMNode->save($filename);}
- function dump_mem($format=false,$encoding=false) {return $this->myDOMNode->saveXML();}
- function get_element_by_id($id) {return new php4DOMElement($this->myDOMNode->getElementById($id),$this);}
- function get_elements_by_tagname($name)
- {
-  $myDOMNodeList=$this->myDOMNode->getElementsByTagName($name);
-  $nodeSet=array();
-  $i=0;
-  if (isset($myDOMNodeList))
-   while ($node=$myDOMNodeList->item($i))
-   {
-    $nodeSet[]=new php4DOMElement($node,$this);
-    $i++;
-   }
-  return $nodeSet;
- }
- function html_dump_mem() {return $this->myDOMNode->saveHTML();}
- function root() {return new php4DOMElement($this->myDOMNode->documentElement,$this);}
-}
-
-class php4DOMElement extends php4DOMNode
-{
- function get_attribute($name) {return $this->myDOMNode->getAttribute($name);}
- function get_elements_by_tagname($name)
- {
-  $myDOMNodeList=$this->myDOMNode->getElementsByTagName($name);
-  $nodeSet=array();
-  $i=0;
-  if (isset($myDOMNodeList))
-   while ($node=$myDOMNodeList->item($i))
-   {
-    $nodeSet[]=new php4DOMElement($node,$this->myOwnerDocument);
-    $i++;
-   }
-  return $nodeSet;
- }
- function has_attribute($name) {return $this->myDOMNode->hasAttribute($name);}
- function remove_attribute($name) {return $this->myDOMNode->removeAttribute($name);}
- function set_attribute($name,$value) {return $this->myDOMNode->setAttribute($name,$value);}
- function tagname() {return $this->myDOMNode->tagName;}
-}
-
-class php4DOMNode
-{
- var $myDOMNode;
- var $myOwnerDocument;
- function php4DOMNode($aDomNode,$aOwnerDocument)
- {
-  $this->myDOMNode=$aDomNode;
-  $this->myOwnerDocument=$aOwnerDocument;
- }
- function __get($name)
- {
-  if ($name=='type') return $this->myDOMNode->nodeType;
-  elseif ($name=='tagname') return $this->myDOMNode->tagName;
-  elseif ($name=='content') return $this->myDOMNode->textContent;
-  else
-  {
-   $myErrors=debug_backtrace();
-   trigger_error('Undefined property: '.get_class($this).'::$'.$name.' ['.$myErrors[0]['file'].':'.$myErrors[0]['line'].']',E_USER_NOTICE);
-   return false;
-  }
- }
- function append_child($newnode) {return new php4DOMElement($this->myDOMNode->appendChild($newnode->myDOMNode),$this->myOwnerDocument);}
- function append_sibling($newnode) {return new php4DOMElement($this->myDOMNode->parentNode->appendChild($newnode->myDOMNode),$this->myOwnerDocument);}
- function attributes()
- {
-  $myDOMNodeList=$this->myDOMNode->attributes;
-  $nodeSet=array();
-  $i=0;
-  if (isset($myDOMNodeList))
-   while ($node=$myDOMNodeList->item($i))
-   {
-    $nodeSet[]=new php4DOMAttr($node,$this->myOwnerDocument);
-    $i++;
-   }
-  return $nodeSet;
- }
- function child_nodes()
- {
-  $myDOMNodeList=$this->myDOMNode->childNodes;
-  $nodeSet=array();
-  $i=0;
-  if (isset($myDOMNodeList))
-   while ($node=$myDOMNodeList->item($i))
-   {
-    $nodeSet[]=new php4DOMElement($node,$this->myOwnerDocument);
-    $i++;
-   }
-  return $nodeSet;
- }
- function children() {return $this->child_nodes();}
- function clone_node($deep=false) {return new php4DOMElement($this->myDOMNode->cloneNode($deep),$this->myOwnerDocument);}
- function first_child() {return new php4DOMElement($this->myDOMNode->firstChild,$this->myOwnerDocument);}
- function get_content() {return $this->myDOMNode->textContent;}
- function has_attributes() {return $this->myDOMNode->hasAttributes();}
- function has_child_nodes() {return $this->myDOMNode->hasChildNodes();}
- function insert_before($newnode,$refnode) {return new php4DOMElement($this->myDOMNode->insertBefore($newnode->myDOMNode,$refnode->myDOMNode),$this->myOwnerDocument);}
- function is_blank_node()
- {
-  $myDOMNodeList=$this->myDOMNode->childNodes;
-  $i=0;
-  if (isset($myDOMNodeList))
-   while ($node=$myDOMNodeList->item($i))
-   {
-    if (($node->nodeType==XML_ELEMENT_NODE)||
-        (($node->nodeType==XML_TEXT_NODE)&&!ereg('^([[:cntrl:]]|[[:space:]])*$',$node->nodeValue)))
-     return false;
-    $i++;
-   }
-  return true;
- }
- function last_child() {return new php4DOMElement($this->myDOMNode->lastChild,$this->myOwnerDocument);}
- function new_child($name,$content)
- {
-  $mySubNode=$this->myDOMNode->ownerDocument->createElement($name);
-  $mySubNode->appendChild($this->myDOMNode->ownerDocument->createTextNode($content));
-  $this->myDOMNode->appendChild($mySubNode);
-  return new php4DOMElement($mySubNode,$this->myOwnerDocument);
- }
- function next_sibling() {return new php4DOMElement($this->myDOMNode->nextSibling,$this->myOwnerDocument);}
- function node_name() {return $this->myDOMNode->localName;}
- function node_type() {return $this->myDOMNode->nodeType;}
- function node_value() {return $this->myDOMNode->nodeValue;}
- function owner_document() {return $this->myOwnerDocument;}
- function parent_node() {return new php4DOMElement($this->myDOMNode->parentNode,$this->myOwnerDocument);}
- function prefix() {return $this->myDOMNode->prefix;}
- function previous_sibling() {return new php4DOMElement($this->myDOMNode->previousSibling,$this->myOwnerDocument);}
- function remove_child($oldchild) {return new php4DOMElement($this->myDOMNode->removeChild($oldchild->myDOMNode),$this->myOwnerDocument);}
- function replace_child($oldnode,$newnode) {return new php4DOMElement($this->myDOMNode->replaceChild($oldnode->myDOMNode,$newnode->myDOMNode),$this->myOwnerDocument);}
- function set_content($text)
- {
-  if (($this->myDOMNode->hasChildNodes())&&($this->myDOMNode->firstChild->nodeType==XML_TEXT_NODE))
-   $this->myDOMNode->removeChild($this->myDOMNode->firstChild);
-  return $this->myDOMNode->appendChild($this->myDOMNode->ownerDocument->createTextNode($text));
- }
-}
-
-class php4DOMNodelist
-{
- var $myDOMNodelist;
- var $nodeset;
- function php4DOMNodelist($aDOMNodelist,$aOwnerDocument)
- {
-  $this->myDOMNodelist=$aDOMNodelist;
-  $this->nodeset=array();
-  $i=0;
-  if (isset($this->myDOMNodelist))
-   while ($node=$this->myDOMNodelist->item($i))
-   {
-    $this->nodeset[]=new php4DOMElement($node,$aOwnerDocument);
-    $i++;
-   }
- }
-}
-
-class php4DOMXPath
-{
- var $myDOMXPath;
- var $myOwnerDocument;
- function php4DOMXPath($dom_document)
- {
-  $this->myOwnerDocument=$dom_document;
-  $this->myDOMXPath=new DOMXPath($dom_document->myDOMNode);
- }
- function query($eval_str,$contextnode)
- {
-  if (isset($contextnode)) return new php4DOMNodelist($this->myDOMXPath->query($eval_str,$contextnode->myDOMNode),$this->myOwnerDocument);
-  else return new php4DOMNodelist($this->myDOMXPath->query($eval_str),$this->myOwnerDocument);
- }
- function xpath_register_ns($prefix,$namespaceURI) {return $this->myDOMXPath->registerNamespace($prefix,$namespaceURI);}
-}
-
-if (extension_loaded('xsl'))
-{//See also: http://alexandre.alapetite.net/doc-alex/xslt-php4-php5/
- function domxml_xslt_stylesheet($xslstring) {return new php4DomXsltStylesheet(DOMDocument::loadXML($xslstring));}
- function domxml_xslt_stylesheet_doc($dom_document) {return new php4DomXsltStylesheet($dom_document);}
- function domxml_xslt_stylesheet_file($xslfile) {return new php4DomXsltStylesheet(DOMDocument::load($xslfile));}
- class php4DomXsltStylesheet
- {
-  var $myxsltProcessor;
-  function php4DomXsltStylesheet($dom_document)
-  {
-   $this->myxsltProcessor=new xsltProcessor();
-   $this->myxsltProcessor->importStyleSheet($dom_document);
-  }
-  function process($dom_document,$xslt_parameters=array(),$param_is_xpath=false)
-  {
-   foreach ($xslt_parameters as $param=>$value)
-    $this->myxsltProcessor->setParameter('',$param,$value);
-   $myphp4DOMDocument=new php4DOMDocument();
-   $myphp4DOMDocument->myDOMNode=$this->myxsltProcessor->transformToDoc($dom_document->myDOMNode);
-   return $myphp4DOMDocument;
-  }
-  function result_dump_file($dom_document,$filename)
-  {
-   $html=$dom_document->myDOMNode->saveHTML();
-   file_put_contents($filename,$html);
-   return $html;
-  }
-  function result_dump_mem($dom_document) {return $dom_document->myDOMNode->saveHTML();}
- }
-}
-?>
\ No newline at end of file
diff --git a/plugins/CasAuthentication/extlib/CAS/domxml-php4-to-php5.php b/plugins/CasAuthentication/extlib/CAS/domxml-php4-to-php5.php
new file mode 100644
index 000000000..1dc4e4b97
--- /dev/null
+++ b/plugins/CasAuthentication/extlib/CAS/domxml-php4-to-php5.php
@@ -0,0 +1,499 @@
+<?php
+/*
+	Requires PHP5, uses built-in DOM extension.
+	To be used in PHP4 scripts using DOMXML extension: allows PHP4/DOMXML scripts to run on PHP5/DOM.
+	(Optional: requires PHP5/XSL extension for domxml_xslt functions, PHP>=5.1 for XPath evaluation functions, and PHP>=5.1/libxml for DOMXML error reports)
+
+	Typical use:
+	{
+		if (PHP_VERSION>='5')
+			require_once('domxml-php4-to-php5.php');
+	}
+
+	Version 1.21, 2008-12-05, http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
+
+	------------------------------------------------------------------
+	Written by Alexandre Alapetite, http://alexandre.alapetite.net/cv/
+
+	Copyright 2004-2008, GNU Lesser General Public License,
+	http://www.gnu.org/licenses/lgpl.html
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU Lesser General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+	GNU Lesser General Public License for more details.
+	You should have received a copy of the GNU Lesser General Public License
+	along with this program. If not, see <http://www.gnu.org/licenses/lgpl.html>
+
+	== Rights and obligations ==
+	- Attribution: You must give the original author credit.
+	- Share Alike: If you alter or transform this library,
+	   you may distribute the resulting library only under the same license GNU/LGPL.
+	- In case of jurisdiction dispute, the French law is authoritative.
+	- Any of these conditions can be waived if you get permission from Alexandre Alapetite.
+	- Not required, but please send to Alexandre Alapetite the modifications you make,
+	   in order to improve this file for the benefit of everybody.
+
+	If you want to distribute this code, please do it as a link to:
+	http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
+*/
+
+define('DOMXML_LOAD_PARSING',0);
+define('DOMXML_LOAD_VALIDATING',1);
+define('DOMXML_LOAD_RECOVERING',2);
+define('DOMXML_LOAD_SUBSTITUTE_ENTITIES',4);
+//define('DOMXML_LOAD_COMPLETE_ATTRS',8);
+define('DOMXML_LOAD_DONT_KEEP_BLANKS',16);
+
+function domxml_new_doc($version) {return new php4DOMDocument();}
+function domxml_new_xmldoc($version) {return new php4DOMDocument();}
+function domxml_open_file($filename,$mode=DOMXML_LOAD_PARSING,&$error=null)
+{
+	$dom=new php4DOMDocument($mode);
+	$errorMode=(func_num_args()>2)&&defined('LIBXML_VERSION');
+	if ($errorMode) libxml_use_internal_errors(true);
+	if (!$dom->myDOMNode->load($filename)) $dom=null;
+	if ($errorMode)
+	{
+		$error=array_map('_error_report',libxml_get_errors());
+		libxml_clear_errors();
+	}
+	return $dom;
+}
+function domxml_open_mem($str,$mode=DOMXML_LOAD_PARSING,&$error=null)
+{
+	$dom=new php4DOMDocument($mode);
+	$errorMode=(func_num_args()>2)&&defined('LIBXML_VERSION');
+	if ($errorMode) libxml_use_internal_errors(true);
+	if (!$dom->myDOMNode->loadXML($str)) $dom=null;
+	if ($errorMode)
+	{
+		$error=array_map('_error_report',libxml_get_errors());
+		libxml_clear_errors();
+	}
+	return $dom;
+}
+function html_doc($html_doc,$from_file=false)
+{
+	$dom=new php4DOMDocument();
+	if ($from_file) $result=$dom->myDOMNode->loadHTMLFile($html_doc);
+	else $result=$dom->myDOMNode->loadHTML($html_doc);
+	return $result ? $dom : null;
+}
+function html_doc_file($filename) {return html_doc($filename,true);}
+function xmldoc($str) {return domxml_open_mem($str);}
+function xmldocfile($filename) {return domxml_open_file($filename);}
+function xpath_eval($xpath_context,$eval_str,$contextnode=null) {return $xpath_context->xpath_eval($eval_str,$contextnode);}
+function xpath_new_context($dom_document) {return new php4DOMXPath($dom_document);}
+function xpath_register_ns($xpath_context,$prefix,$namespaceURI) {return $xpath_context->myDOMXPath->registerNamespace($prefix,$namespaceURI);}
+function _entityDecode($text) {return html_entity_decode(strtr($text,array('&apos;'=>'\'')),ENT_QUOTES,'UTF-8');}
+function _error_report($error) {return array('errormessage'=>$error->message,'nodename'=>'','line'=>$error->line,'col'=>$error->column)+($error->file==''?array():array('directory'=>dirname($error->file),'file'=>basename($error->file)));}
+
+class php4DOMAttr extends php4DOMNode
+{
+	function __get($name)
+	{
+		if ($name==='name') return $this->myDOMNode->name;
+		else return parent::__get($name);
+	}
+	function name() {return $this->myDOMNode->name;}
+	function set_content($text) {}
+	//function set_value($content) {return $this->myDOMNode->value=htmlspecialchars($content,ENT_QUOTES);}
+	function specified() {return $this->myDOMNode->specified;}
+	function value() {return $this->myDOMNode->value;}
+}
+
+class php4DOMDocument extends php4DOMNode
+{
+	function php4DOMDocument($mode=DOMXML_LOAD_PARSING)
+	{
+		$this->myDOMNode=new DOMDocument();
+		$this->myOwnerDocument=$this;
+		if ($mode & DOMXML_LOAD_VALIDATING) $this->myDOMNode->validateOnParse=true;
+		if ($mode & DOMXML_LOAD_RECOVERING) $this->myDOMNode->recover=true;
+		if ($mode & DOMXML_LOAD_SUBSTITUTE_ENTITIES) $this->myDOMNode->substituteEntities=true;
+		if ($mode & DOMXML_LOAD_DONT_KEEP_BLANKS) $this->myDOMNode->preserveWhiteSpace=false;
+	}
+	function add_root($name)
+	{
+		if ($this->myDOMNode->hasChildNodes()) $this->myDOMNode->removeChild($this->myDOMNode->firstChild);
+		return new php4DOMElement($this->myDOMNode->appendChild($this->myDOMNode->createElement($name)),$this->myOwnerDocument);
+	}
+	function create_attribute($name,$value)
+	{
+		$myAttr=$this->myDOMNode->createAttribute($name);
+		$myAttr->value=htmlspecialchars($value,ENT_QUOTES);
+		return new php4DOMAttr($myAttr,$this);
+	}
+	function create_cdata_section($content) {return new php4DOMNode($this->myDOMNode->createCDATASection($content),$this);}
+	function create_comment($data) {return new php4DOMNode($this->myDOMNode->createComment($data),$this);}
+	function create_element($name) {return new php4DOMElement($this->myDOMNode->createElement($name),$this);}
+	function create_element_ns($uri,$name,$prefix=null)
+	{
+		if ($prefix==null) $prefix=$this->myDOMNode->lookupPrefix($uri);
+		if (($prefix==null)&&(($this->myDOMNode->documentElement==null)||(!$this->myDOMNode->documentElement->isDefaultNamespace($uri)))) $prefix='a'.sprintf('%u',crc32($uri));
+		return new php4DOMElement($this->myDOMNode->createElementNS($uri,$prefix==null ? $name : $prefix.':'.$name),$this);
+	}
+	function create_entity_reference($content) {return new php4DOMNode($this->myDOMNode->createEntityReference($content),$this);} //By Walter Ebert 2007-01-22
+	function create_processing_instruction($target,$data=''){return new php4DomProcessingInstruction($this->myDOMNode->createProcessingInstruction($target,$data),$this);}
+	function create_text_node($content) {return new php4DOMText($this->myDOMNode->createTextNode($content),$this);}
+	function document_element() {return parent::_newDOMElement($this->myDOMNode->documentElement,$this);}
+	function dump_file($filename,$compressionmode=false,$format=false)
+	{
+		$format0=$this->myDOMNode->formatOutput;
+		$this->myDOMNode->formatOutput=$format;
+		$res=$this->myDOMNode->save($filename);
+		$this->myDOMNode->formatOutput=$format0;
+		return $res;
+	}
+	function dump_mem($format=false,$encoding=false)
+	{
+		$format0=$this->myDOMNode->formatOutput;
+		$this->myDOMNode->formatOutput=$format;
+		$encoding0=$this->myDOMNode->encoding;
+		if ($encoding) $this->myDOMNode->encoding=$encoding;
+		$dump=$this->myDOMNode->saveXML();
+		$this->myDOMNode->formatOutput=$format0;
+		if ($encoding) $this->myDOMNode->encoding= $encoding0=='' ? 'UTF-8' : $encoding0; //UTF-8 is XML default encoding
+		return $dump;
+	}
+	function free()
+	{
+		if ($this->myDOMNode->hasChildNodes()) $this->myDOMNode->removeChild($this->myDOMNode->firstChild);
+		$this->myDOMNode=null;
+		$this->myOwnerDocument=null;
+	}
+	function get_element_by_id($id) {return parent::_newDOMElement($this->myDOMNode->getElementById($id),$this);}
+	function get_elements_by_tagname($name)
+	{
+		$myDOMNodeList=$this->myDOMNode->getElementsByTagName($name);
+		$nodeSet=array();
+		$i=0;
+		if (isset($myDOMNodeList))
+			while ($node=$myDOMNodeList->item($i++)) $nodeSet[]=new php4DOMElement($node,$this);
+		return $nodeSet;
+	}
+	function html_dump_mem() {return $this->myDOMNode->saveHTML();}
+	function root() {return parent::_newDOMElement($this->myDOMNode->documentElement,$this);}
+	function xinclude() {return $this->myDOMNode->xinclude();}
+	function xpath_new_context() {return new php4DOMXPath($this);}
+}
+
+class php4DOMElement extends php4DOMNode
+{
+	function add_namespace($uri,$prefix)
+	{
+		if ($this->myDOMNode->hasAttributeNS('http://www.w3.org/2000/xmlns/',$prefix)) return false;
+		else
+		{
+			$this->myDOMNode->setAttributeNS('http://www.w3.org/2000/xmlns/','xmlns:'.$prefix,$uri); //By Daniel Walker 2006-09-08
+			return true;
+		}
+	}
+	function get_attribute($name) {return $this->myDOMNode->getAttribute($name);}
+	function get_attribute_node($name) {return parent::_newDOMElement($this->myDOMNode->getAttributeNode($name),$this->myOwnerDocument);}
+	function get_elements_by_tagname($name)
+	{
+		$myDOMNodeList=$this->myDOMNode->getElementsByTagName($name);
+		$nodeSet=array();
+		$i=0;
+		if (isset($myDOMNodeList))
+			while ($node=$myDOMNodeList->item($i++)) $nodeSet[]=new php4DOMElement($node,$this->myOwnerDocument);
+		return $nodeSet;
+	}
+	function has_attribute($name) {return $this->myDOMNode->hasAttribute($name);}
+	function remove_attribute($name) {return $this->myDOMNode->removeAttribute($name);}
+	function set_attribute($name,$value)
+	{
+		//return $this->myDOMNode->setAttribute($name,$value); //Does not return a DomAttr
+		$myAttr=$this->myDOMNode->ownerDocument->createAttribute($name);
+		$myAttr->value=htmlspecialchars($value,ENT_QUOTES); //Entity problem reported by AL-DesignWorks 2007-09-07
+		$this->myDOMNode->setAttributeNode($myAttr);
+		return new php4DOMAttr($myAttr,$this->myOwnerDocument);
+	}
+	/*function set_attribute_node($attr)
+	{
+		$this->myDOMNode->setAttributeNode($this->_importNode($attr));
+		return $attr;
+	}*/
+	function set_name($name)
+	{
+		if ($this->myDOMNode->prefix=='') $newNode=$this->myDOMNode->ownerDocument->createElement($name);
+		else $newNode=$this->myDOMNode->ownerDocument->createElementNS($this->myDOMNode->namespaceURI,$this->myDOMNode->prefix.':'.$name);
+		$myDOMNodeList=$this->myDOMNode->attributes;
+		$i=0;
+		if (isset($myDOMNodeList))
+			while ($node=$myDOMNodeList->item($i++))
+				if ($node->namespaceURI=='') $newNode->setAttribute($node->name,$node->value);
+				else $newNode->setAttributeNS($node->namespaceURI,$node->nodeName,$node->value);
+		$myDOMNodeList=$this->myDOMNode->childNodes;
+		if (isset($myDOMNodeList))
+			while ($node=$myDOMNodeList->item(0)) $newNode->appendChild($node);
+		$this->myDOMNode->parentNode->replaceChild($newNode,$this->myDOMNode);
+		$this->myDOMNode=$newNode;
+		return true;
+	}
+	function tagname() {return $this->tagname;}
+}
+
+class php4DOMNode
+{
+	public $myDOMNode;
+	public $myOwnerDocument;
+	function php4DOMNode($aDomNode,$aOwnerDocument)
+	{
+		$this->myDOMNode=$aDomNode;
+		$this->myOwnerDocument=$aOwnerDocument;
+	}
+	function __get($name)
+	{
+		switch ($name)
+		{
+			case 'type': return $this->myDOMNode->nodeType;
+			case 'tagname': return ($this->myDOMNode->nodeType===XML_ELEMENT_NODE) ? $this->myDOMNode->localName : $this->myDOMNode->tagName; //Avoid namespace prefix for DOMElement
+			case 'content': return $this->myDOMNode->textContent;
+			case 'value': return $this->myDOMNode->value;
+			default:
+				$myErrors=debug_backtrace();
+				trigger_error('Undefined property: '.get_class($this).'::$'.$name.' ['.$myErrors[0]['file'].':'.$myErrors[0]['line'].']',E_USER_NOTICE);
+				return false;
+		}
+	}
+	function add_child($newnode) {return append_child($newnode);}
+	function add_namespace($uri,$prefix) {return false;}
+	function append_child($newnode) {return self::_newDOMElement($this->myDOMNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
+	function append_sibling($newnode) {return self::_newDOMElement($this->myDOMNode->parentNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
+	function attributes()
+	{
+		$myDOMNodeList=$this->myDOMNode->attributes;
+		if (!(isset($myDOMNodeList)&&$this->myDOMNode->hasAttributes())) return null;
+		$nodeSet=array();
+		$i=0;
+		while ($node=$myDOMNodeList->item($i++)) $nodeSet[]=new php4DOMAttr($node,$this->myOwnerDocument);
+		return $nodeSet;
+	}
+	function child_nodes()
+	{
+		$myDOMNodeList=$this->myDOMNode->childNodes;
+		$nodeSet=array();
+		$i=0;
+		if (isset($myDOMNodeList))
+			while ($node=$myDOMNodeList->item($i++)) $nodeSet[]=self::_newDOMElement($node,$this->myOwnerDocument);
+		return $nodeSet;
+	}
+	function children() {return $this->child_nodes();}
+	function clone_node($deep=false) {return self::_newDOMElement($this->myDOMNode->cloneNode($deep),$this->myOwnerDocument);}
+	//dump_node($node) should only be called on php4DOMDocument
+	function dump_node($node=null) {return $node==null ? $this->myOwnerDocument->myDOMNode->saveXML($this->myDOMNode) : $this->myOwnerDocument->myDOMNode->saveXML($node->myDOMNode);}
+	function first_child() {return self::_newDOMElement($this->myDOMNode->firstChild,$this->myOwnerDocument);}
+	function get_content() {return $this->myDOMNode->textContent;}
+	function has_attributes() {return $this->myDOMNode->hasAttributes();}
+	function has_child_nodes() {return $this->myDOMNode->hasChildNodes();}
+	function insert_before($newnode,$refnode) {return self::_newDOMElement($this->myDOMNode->insertBefore($this->_importNode($newnode),$refnode==null?null:$refnode->myDOMNode),$this->myOwnerDocument);}
+	function is_blank_node() {return ($this->myDOMNode->nodeType===XML_TEXT_NODE)&&preg_match('%^\s*$%',$this->myDOMNode->nodeValue);}
+	function last_child() {return self::_newDOMElement($this->myDOMNode->lastChild,$this->myOwnerDocument);}
+	function new_child($name,$content)
+	{
+		$mySubNode=$this->myDOMNode->ownerDocument->createElement($name);
+		$mySubNode->appendChild($this->myDOMNode->ownerDocument->createTextNode(_entityDecode($content)));
+		$this->myDOMNode->appendChild($mySubNode);
+		return new php4DOMElement($mySubNode,$this->myOwnerDocument);
+	}
+	function next_sibling() {return self::_newDOMElement($this->myDOMNode->nextSibling,$this->myOwnerDocument);}
+	function node_name() {return ($this->myDOMNode->nodeType===XML_ELEMENT_NODE) ? $this->myDOMNode->localName : $this->myDOMNode->nodeName;} //Avoid namespace prefix for DOMElement
+	function node_type() {return $this->myDOMNode->nodeType;}
+	function node_value() {return $this->myDOMNode->nodeValue;}
+	function owner_document() {return $this->myOwnerDocument;}
+	function parent_node() {return self::_newDOMElement($this->myDOMNode->parentNode,$this->myOwnerDocument);}
+	function prefix() {return $this->myDOMNode->prefix;}
+	function previous_sibling() {return self::_newDOMElement($this->myDOMNode->previousSibling,$this->myOwnerDocument);}
+	function remove_child($oldchild) {return self::_newDOMElement($this->myDOMNode->removeChild($oldchild->myDOMNode),$this->myOwnerDocument);}
+	function replace_child($newnode,$oldnode) {return self::_newDOMElement($this->myDOMNode->replaceChild($this->_importNode($newnode),$oldnode->myDOMNode),$this->myOwnerDocument);}
+	function replace_node($newnode) {return self::_newDOMElement($this->myDOMNode->parentNode->replaceChild($this->_importNode($newnode),$this->myDOMNode),$this->myOwnerDocument);}
+	function set_content($text) {return $this->myDOMNode->appendChild($this->myDOMNode->ownerDocument->createTextNode(_entityDecode($text)));} //Entity problem reported by AL-DesignWorks 2007-09-07
+	//function set_name($name) {return $this->myOwnerDocument->renameNode($this->myDOMNode,$this->myDOMNode->namespaceURI,$name);}
+	function set_namespace($uri,$prefix=null)
+	{//Contributions by Daniel Walker 2006-09-08
+		$nsprefix=$this->myDOMNode->lookupPrefix($uri);
+		if ($nsprefix==null)
+		{
+			$nsprefix= $prefix==null ? $nsprefix='a'.sprintf('%u',crc32($uri)) : $prefix;
+			if ($this->myDOMNode->nodeType===XML_ATTRIBUTE_NODE)
+			{
+				if (($prefix!=null)&&$this->myDOMNode->ownerElement->hasAttributeNS('http://www.w3.org/2000/xmlns/',$nsprefix)&&
+					($this->myDOMNode->ownerElement->getAttributeNS('http://www.w3.org/2000/xmlns/',$nsprefix)!=$uri))
+				{//Remove namespace
+					$parent=$this->myDOMNode->ownerElement;
+					$parent->removeAttributeNode($this->myDOMNode);
+					$parent->setAttribute($this->myDOMNode->localName,$this->myDOMNode->nodeValue);
+					$this->myDOMNode=$parent->getAttributeNode($this->myDOMNode->localName);
+					return;
+				}
+				$this->myDOMNode->ownerElement->setAttributeNS('http://www.w3.org/2000/xmlns/','xmlns:'.$nsprefix,$uri);
+			}
+		}
+		if ($this->myDOMNode->nodeType===XML_ATTRIBUTE_NODE)
+		{
+			$parent=$this->myDOMNode->ownerElement;
+			$parent->removeAttributeNode($this->myDOMNode);
+			$parent->setAttributeNS($uri,$nsprefix.':'.$this->myDOMNode->localName,$this->myDOMNode->nodeValue);
+			$this->myDOMNode=$parent->getAttributeNodeNS($uri,$this->myDOMNode->localName);
+		}
+		elseif ($this->myDOMNode->nodeType===XML_ELEMENT_NODE)
+		{
+			$NewNode=$this->myDOMNode->ownerDocument->createElementNS($uri,$nsprefix.':'.$this->myDOMNode->localName);
+			foreach ($this->myDOMNode->attributes as $n) $NewNode->appendChild($n->cloneNode(true));
+			foreach ($this->myDOMNode->childNodes as $n) $NewNode->appendChild($n->cloneNode(true));
+			$xpath=new DOMXPath($this->myDOMNode->ownerDocument);
+			$myDOMNodeList=$xpath->query('namespace::*[name()!="xml"]',$this->myDOMNode); //Add old namespaces
+			foreach ($myDOMNodeList as $n) $NewNode->setAttributeNS('http://www.w3.org/2000/xmlns/',$n->nodeName,$n->nodeValue); 
+			$this->myDOMNode->parentNode->replaceChild($NewNode,$this->myDOMNode);
+			$this->myDOMNode=$NewNode;
+		}
+	}
+	function unlink_node()
+	{
+		if ($this->myDOMNode->parentNode!=null)
+		{
+			if ($this->myDOMNode->nodeType===XML_ATTRIBUTE_NODE) $this->myDOMNode->parentNode->removeAttributeNode($this->myDOMNode);
+			else $this->myDOMNode->parentNode->removeChild($this->myDOMNode);
+		}
+	}
+	protected function _importNode($newnode) {return $this->myOwnerDocument===$newnode->myOwnerDocument ? $newnode->myDOMNode : $this->myOwnerDocument->myDOMNode->importNode($newnode->myDOMNode,true);} //To import DOMNode from another DOMDocument
+	static function _newDOMElement($aDOMNode,$aOwnerDocument)
+	{//Check the PHP5 DOMNode before creating a new associated PHP4 DOMNode wrapper
+		if ($aDOMNode==null) return null;
+		switch ($aDOMNode->nodeType)
+		{
+			case XML_ELEMENT_NODE: return new php4DOMElement($aDOMNode,$aOwnerDocument);
+			case XML_TEXT_NODE: return new php4DOMText($aDOMNode,$aOwnerDocument);
+			case XML_ATTRIBUTE_NODE: return new php4DOMAttr($aDOMNode,$aOwnerDocument);
+			case XML_PI_NODE: return new php4DomProcessingInstruction($aDOMNode,$aOwnerDocument);
+			default: return new php4DOMNode($aDOMNode,$aOwnerDocument);
+		}
+	}
+}
+
+class php4DomProcessingInstruction extends php4DOMNode
+{
+	function data() {return $this->myDOMNode->data;}
+	function target() {return $this->myDOMNode->target;}
+}
+
+class php4DOMText extends php4DOMNode
+{
+	function __get($name)
+	{
+		if ($name==='tagname') return '#text';
+		else return parent::__get($name);
+	}
+	function tagname() {return '#text';}
+	function set_content($text) {$this->myDOMNode->nodeValue=$text; return true;}
+}
+
+if (!defined('XPATH_NODESET'))
+{
+	define('XPATH_UNDEFINED',0);
+	define('XPATH_NODESET',1);
+	define('XPATH_BOOLEAN',2);
+	define('XPATH_NUMBER',3);
+	define('XPATH_STRING',4);
+	/*define('XPATH_POINT',5);
+	define('XPATH_RANGE',6);
+	define('XPATH_LOCATIONSET',7);
+	define('XPATH_USERS',8);
+	define('XPATH_XSLT_TREE',9);*/
+}
+
+class php4DOMNodelist
+{
+	private $myDOMNodelist;
+	public $nodeset;
+	public $type=XPATH_UNDEFINED;
+	public $value;
+	function php4DOMNodelist($aDOMNodelist,$aOwnerDocument)
+	{
+		if (!isset($aDOMNodelist)) return; 
+		elseif (is_object($aDOMNodelist)||is_array($aDOMNodelist))
+		{
+			if ($aDOMNodelist->length>0)
+			{
+				$this->myDOMNodelist=$aDOMNodelist;
+				$this->nodeset=array();
+				$this->type=XPATH_NODESET;
+				$i=0;
+				while ($node=$this->myDOMNodelist->item($i++)) $this->nodeset[]=php4DOMNode::_newDOMElement($node,$aOwnerDocument);
+			}
+		}
+		elseif (is_int($aDOMNodelist)||is_float($aDOMNodelist))
+		{
+			$this->type=XPATH_NUMBER;
+			$this->value=$aDOMNodelist;
+		}
+		elseif (is_bool($aDOMNodelist))
+		{
+			$this->type=XPATH_BOOLEAN;
+			$this->value=$aDOMNodelist;
+		}
+		elseif (is_string($aDOMNodelist))
+		{
+			$this->type=XPATH_STRING;
+			$this->value=$aDOMNodelist;
+		}
+	}
+}
+
+class php4DOMXPath
+{
+	public $myDOMXPath;
+	private $myOwnerDocument;
+	function php4DOMXPath($dom_document)
+	{
+		//TODO: If $dom_document is a DomElement, make that default $contextnode and modify XPath. Ex: '/test'
+		$this->myOwnerDocument=$dom_document->myOwnerDocument;
+		$this->myDOMXPath=new DOMXPath($this->myOwnerDocument->myDOMNode);
+	}
+	function xpath_eval($eval_str,$contextnode=null)
+	{
+		if (method_exists($this->myDOMXPath,'evaluate')) $xp=isset($contextnode) ? $this->myDOMXPath->evaluate($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->evaluate($eval_str);
+		else $xp=isset($contextnode) ? $this->myDOMXPath->query($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->query($eval_str);
+		$xp=new php4DOMNodelist($xp,$this->myOwnerDocument);
+		return ($xp->type===XPATH_UNDEFINED) ? false : $xp;
+	}
+	function xpath_register_ns($prefix,$namespaceURI) {return $this->myDOMXPath->registerNamespace($prefix,$namespaceURI);}
+}
+
+if (extension_loaded('xsl'))
+{//See also: http://alexandre.alapetite.net/doc-alex/xslt-php4-php5/
+	function domxml_xslt_stylesheet($xslstring) {return new php4DomXsltStylesheet(DOMDocument::loadXML($xslstring));}
+	function domxml_xslt_stylesheet_doc($dom_document) {return new php4DomXsltStylesheet($dom_document);}
+	function domxml_xslt_stylesheet_file($xslfile) {return new php4DomXsltStylesheet(DOMDocument::load($xslfile));}
+	class php4DomXsltStylesheet
+	{
+		private $myxsltProcessor;
+		function php4DomXsltStylesheet($dom_document)
+		{
+			$this->myxsltProcessor=new xsltProcessor();
+			$this->myxsltProcessor->importStyleSheet($dom_document);
+		}
+		function process($dom_document,$xslt_parameters=array(),$param_is_xpath=false)
+		{
+			foreach ($xslt_parameters as $param=>$value) $this->myxsltProcessor->setParameter('',$param,$value);
+			$myphp4DOMDocument=new php4DOMDocument();
+			$myphp4DOMDocument->myDOMNode=$this->myxsltProcessor->transformToDoc($dom_document->myDOMNode);
+			return $myphp4DOMDocument;
+		}
+		function result_dump_file($dom_document,$filename)
+		{
+			$html=$dom_document->myDOMNode->saveHTML();
+			file_put_contents($filename,$html);
+			return $html;
+		}
+		function result_dump_mem($dom_document) {return $dom_document->myDOMNode->saveHTML();}
+	}
+}
+?>
diff --git a/plugins/CasAuthentication/extlib/CAS/languages/catalan.php b/plugins/CasAuthentication/extlib/CAS/languages/catalan.php
index 0b139c7ca..3d67473d9 100644
--- a/plugins/CasAuthentication/extlib/CAS/languages/catalan.php
+++ b/plugins/CasAuthentication/extlib/CAS/languages/catalan.php
@@ -1,27 +1,27 @@
-<?php
-
-/**
- * @file languages/spanish.php
- * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
- * @sa @link internalLang Internationalization @endlink
- * @ingroup internalLang
- */
-
-$this->_strings = array(
- CAS_STR_USING_SERVER 
- => 'usant servidor',
- CAS_STR_AUTHENTICATION_WANTED 
- => 'Autentificació CAS necessària!',
- CAS_STR_LOGOUT 
- => 'Sortida de CAS necessària!',
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
- => 'Ja hauria d\ haver estat redireccionat al servidor CAS. Feu click <a href="%s">aquí</a> per a continuar.',
- CAS_STR_AUTHENTICATION_FAILED 
- => 'Autentificació CAS fallida!',
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
- => '<p>No estàs autentificat.</p><p>Pots tornar a intentar-ho fent click <a href="%s">aquí</a>.</p><p>Si el problema persisteix hauría de contactar amb l\'<a href="mailto:%s">administrador d\'aquest llocc</a>.</p>',
- CAS_STR_SERVICE_UNAVAILABLE
- => 'El servei `<b>%s</b>\' no està disponible (<b>%s</b>).'
-);
-
-?>
+<?php

+

+/**

+ * @file languages/spanish.php

+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>

+ * @sa @link internalLang Internationalization @endlink

+ * @ingroup internalLang

+ */

+

+$this->_strings = array(

+ CAS_STR_USING_SERVER 

+ => 'usant servidor',

+ CAS_STR_AUTHENTICATION_WANTED 

+ => 'Autentificació CAS necessària!',

+ CAS_STR_LOGOUT 

+ => 'Sortida de CAS necessària!',

+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 

+ => 'Ja hauria d\ haver estat redireccionat al servidor CAS. Feu click <a href="%s">aquí</a> per a continuar.',

+ CAS_STR_AUTHENTICATION_FAILED 

+ => 'Autentificació CAS fallida!',

+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 

+ => '<p>No estàs autentificat.</p><p>Pots tornar a intentar-ho fent click <a href="%s">aquí</a>.</p><p>Si el problema persisteix hauría de contactar amb l\'<a href="mailto:%s">administrador d\'aquest llocc</a>.</p>',

+ CAS_STR_SERVICE_UNAVAILABLE

+ => 'El servei `<b>%s</b>\' no està disponible (<b>%s</b>).'

+);

+

+?>

diff --git a/plugins/CasAuthentication/extlib/CAS/languages/english.php b/plugins/CasAuthentication/extlib/CAS/languages/english.php
index d38d42c1f..c14345031 100644
--- a/plugins/CasAuthentication/extlib/CAS/languages/english.php
+++ b/plugins/CasAuthentication/extlib/CAS/languages/english.php
@@ -1,27 +1,27 @@
-<?php
-
-/**
- * @file languages/english.php
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- * @sa @link internalLang Internationalization @endlink
- * @ingroup internalLang
- */
-
-$this->_strings = array(
- CAS_STR_USING_SERVER 
- => 'using server',
- CAS_STR_AUTHENTICATION_WANTED 
- => 'CAS Authentication wanted!',
- CAS_STR_LOGOUT 
- => 'CAS logout wanted!',
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
- => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',
- CAS_STR_AUTHENTICATION_FAILED 
- => 'CAS Authentication failed!',
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
- => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',
- CAS_STR_SERVICE_UNAVAILABLE
- => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'
-);
-
+<?php

+

+/**

+ * @file languages/english.php

+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>

+ * @sa @link internalLang Internationalization @endlink

+ * @ingroup internalLang

+ */

+

+$this->_strings = array(

+ CAS_STR_USING_SERVER 

+ => 'using server',

+ CAS_STR_AUTHENTICATION_WANTED 

+ => 'CAS Authentication wanted!',

+ CAS_STR_LOGOUT 

+ => 'CAS logout wanted!',

+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 

+ => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',

+ CAS_STR_AUTHENTICATION_FAILED 

+ => 'CAS Authentication failed!',

+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 

+ => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',

+ CAS_STR_SERVICE_UNAVAILABLE

+ => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'

+);

+

 ?>
\ No newline at end of file
diff --git a/plugins/CasAuthentication/extlib/CAS/languages/french.php b/plugins/CasAuthentication/extlib/CAS/languages/french.php
index 32d141685..b077ec02e 100644
--- a/plugins/CasAuthentication/extlib/CAS/languages/french.php
+++ b/plugins/CasAuthentication/extlib/CAS/languages/french.php
@@ -1,28 +1,28 @@
-<?php
-
-/**
- * @file languages/english.php
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- * @sa @link internalLang Internationalization @endlink
- * @ingroup internalLang
- */
-
-$this->_strings = array(
- CAS_STR_USING_SERVER 
- => 'utilisant le serveur',
- CAS_STR_AUTHENTICATION_WANTED 
- => 'Authentication CAS nécessaire&nbsp;!',
- CAS_STR_LOGOUT 
- => 'Déconnexion demandée&nbsp;!',
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
- => 'Vous auriez du etre redirigé(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
- CAS_STR_AUTHENTICATION_FAILED 
- => 'Authentification CAS infructueuse&nbsp;!',
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
- => '<p>Vous n\'avez pas été authentifié(e).</p><p>Vous pouvez soumettre votre requete à nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le problème persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
- CAS_STR_SERVICE_UNAVAILABLE
- => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'
-
-);
-
+<?php

+

+/**

+ * @file languages/english.php

+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>

+ * @sa @link internalLang Internationalization @endlink

+ * @ingroup internalLang

+ */

+

+$this->_strings = array(

+ CAS_STR_USING_SERVER 

+ => 'utilisant le serveur',

+ CAS_STR_AUTHENTICATION_WANTED 

+ => 'Authentication CAS n�cessaire&nbsp;!',

+ CAS_STR_LOGOUT 

+ => 'D�connexion demand�e&nbsp;!',

+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 

+ => 'Vous auriez du etre redirig�(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',

+ CAS_STR_AUTHENTICATION_FAILED 

+ => 'Authentification CAS infructueuse&nbsp;!',

+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 

+ => '<p>Vous n\'avez pas �t� authentifi�(e).</p><p>Vous pouvez soumettre votre requete � nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le probl�me persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',

+ CAS_STR_SERVICE_UNAVAILABLE

+ => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'

+

+);

+

 ?>
\ No newline at end of file
diff --git a/plugins/CasAuthentication/extlib/CAS/languages/german.php b/plugins/CasAuthentication/extlib/CAS/languages/german.php
index 55c3238fd..29daeb35d 100644
--- a/plugins/CasAuthentication/extlib/CAS/languages/german.php
+++ b/plugins/CasAuthentication/extlib/CAS/languages/german.php
@@ -1,27 +1,27 @@
-<?php
-
-/**
- * @file languages/german.php
- * @author Henrik Genssen <hg at mediafactory.de>
- * @sa @link internalLang Internationalization @endlink
- * @ingroup internalLang
- */
-
-$this->_strings = array(
- CAS_STR_USING_SERVER 
- => 'via Server',
- CAS_STR_AUTHENTICATION_WANTED 
- => 'CAS Authentifizierung erforderlich!',
- CAS_STR_LOGOUT 
- => 'CAS Abmeldung!',
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
- => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',
- CAS_STR_AUTHENTICATION_FAILED 
- => 'CAS Anmeldung fehlgeschlagen!',
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
- => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',
- CAS_STR_SERVICE_UNAVAILABLE
- => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'
-);
-
+<?php

+

+/**

+ * @file languages/german.php

+ * @author Henrik Genssen <hg at mediafactory.de>

+ * @sa @link internalLang Internationalization @endlink

+ * @ingroup internalLang

+ */

+

+$this->_strings = array(

+ CAS_STR_USING_SERVER 

+ => 'via Server',

+ CAS_STR_AUTHENTICATION_WANTED 

+ => 'CAS Authentifizierung erforderlich!',

+ CAS_STR_LOGOUT 

+ => 'CAS Abmeldung!',

+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 

+ => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',

+ CAS_STR_AUTHENTICATION_FAILED 

+ => 'CAS Anmeldung fehlgeschlagen!',

+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 

+ => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',

+ CAS_STR_SERVICE_UNAVAILABLE

+ => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'

+);

+

 ?>
\ No newline at end of file
diff --git a/plugins/CasAuthentication/extlib/CAS/languages/greek.php b/plugins/CasAuthentication/extlib/CAS/languages/greek.php
index d41bf783b..fdff77e4e 100644
--- a/plugins/CasAuthentication/extlib/CAS/languages/greek.php
+++ b/plugins/CasAuthentication/extlib/CAS/languages/greek.php
@@ -1,27 +1,27 @@
-<?php
-
-/**
- * @file languages/greek.php
- * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
- * @sa @link internalLang Internationalization @endlink
- * @ingroup internalLang
- */
-
-$this->_strings = array(
- CAS_STR_USING_SERVER 
- => '÷ñçóéìïðïéåßôáé ï åîõðçñåôçôÞò',
- CAS_STR_AUTHENTICATION_WANTED 
- => 'Áðáéôåßôáé ç ôáõôïðïßçóç CAS!',
- CAS_STR_LOGOUT 
- => 'Áðáéôåßôáé ç áðïóýíäåóç áðü CAS!',
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
- => 'Èá Ýðñåðå íá åß÷áôå áíáêáôåõèõíèåß óôïí åîõðçñåôçôÞ CAS. ÊÜíôå êëßê <a href="%s">åäþ</a> ãéá íá óõíå÷ßóåôå.',
- CAS_STR_AUTHENTICATION_FAILED 
- => 'Ç ôáõôïðïßçóç CAS áðÝôõ÷å!',
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
- => '<p>Äåí ôáõôïðïéçèÞêáôå.</p><p>Ìðïñåßôå íá îáíáðñïóðáèÞóåôå, êÜíïíôáò êëßê <a href="%s">åäþ</a>.</p><p>Åáí ôï ðñüâëçìá åðéìåßíåé, åëÜôå óå åðáöÞ ìå ôïí <a href="mailto:%s">äéá÷åéñéóôÞ</a>.</p>',
- CAS_STR_SERVICE_UNAVAILABLE
- => 'Ç õðçñåóßá `<b>%s</b>\' äåí åßíáé äéáèÝóéìç (<b>%s</b>).'
-);
-
+<?php

+

+/**

+ * @file languages/greek.php

+ * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>

+ * @sa @link internalLang Internationalization @endlink

+ * @ingroup internalLang

+ */

+

+$this->_strings = array(

+ CAS_STR_USING_SERVER 

+ => '��������������� � ������������',

+ CAS_STR_AUTHENTICATION_WANTED 

+ => '���������� � ����������� CAS!',

+ CAS_STR_LOGOUT 

+ => '���������� � ���������� ��� CAS!',

+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 

+ => '�� ������ �� ������ �������������� ���� ����������� CAS. ����� ���� <a href="%s">���</a> ��� �� ����������.',

+ CAS_STR_AUTHENTICATION_FAILED 

+ => '� ����������� CAS �������!',

+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 

+ => '<p>��� ���������������.</p><p>�������� �� ����������������, �������� ���� <a href="%s">���</a>.</p><p>��� �� �������� ���������, ����� �� ����� �� ��� <a href="mailto:%s">�����������</a>.</p>',

+ CAS_STR_SERVICE_UNAVAILABLE

+ => '� �������� `<b>%s</b>\' ��� ����� ��������� (<b>%s</b>).'

+);

+

 ?>
\ No newline at end of file
diff --git a/plugins/CasAuthentication/extlib/CAS/languages/japanese.php b/plugins/CasAuthentication/extlib/CAS/languages/japanese.php
index 333bb17b6..76ebe77bc 100644
--- a/plugins/CasAuthentication/extlib/CAS/languages/japanese.php
+++ b/plugins/CasAuthentication/extlib/CAS/languages/japanese.php
@@ -11,17 +11,17 @@ $this->_strings = array(
  CAS_STR_USING_SERVER 
  => 'using server',
  CAS_STR_AUTHENTICATION_WANTED 
- => 'CAS¤Ë¤è¤ëǧ¾Ú¤ò¹Ô¤¤¤Þ¤¹',
+ => 'CAS�ˤ��ǧ�ڤ�Ԥ��ޤ�',
  CAS_STR_LOGOUT 
- => 'CAS¤«¤é¥í¥°¥¢¥¦¥È¤·¤Þ¤¹!',
+ => 'CAS����?�����Ȥ��ޤ�!',
  CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
- => 'CAS¥µ¡¼¥Ð¤Ë¹Ô¤¯É¬Íפ¬¤¢¤ê¤Þ¤¹¡£¼«Æ°Åª¤ËžÁ÷¤µ¤ì¤Ê¤¤¾ì¹ç¤Ï <a href="%s">¤³¤Á¤é</a> ¤ò¥¯¥ê¥Ã¥¯¤·¤Æ³¹Ô¤·¤Þ¤¹¡£',
+ => 'CAS�����Ф˹Ԥ�ɬ�פ�����ޤ�����ưŪ��ž������ʤ����� <a href="%s">������</a> �򥯥�å�����³�Ԥ��ޤ���',
  CAS_STR_AUTHENTICATION_FAILED 
- => 'CAS¤Ë¤è¤ëǧ¾Ú¤Ë¼ºÇÔ¤·¤Þ¤·¤¿',
+ => 'CAS�ˤ��ǧ�ڤ˼��Ԥ��ޤ���',
  CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
- => '<p>ǧ¾Ú¤Ç¤­¤Þ¤»¤ó¤Ç¤·¤¿.</p><p>¤â¤¦°ìÅ٥ꥯ¥¨¥¹¥È¤òÁ÷¿®¤¹¤ë¾ì¹ç¤Ï<a href="%s">¤³¤Á¤é</a>¤ò¥¯¥ê¥Ã¥¯.</p><p>ÌäÂ꤬²ò·è¤·¤Ê¤¤¾ì¹ç¤Ï <a href="mailto:%s">¤³¤Î¥µ¥¤¥È¤Î´ÉÍý¼Ô</a>¤ËÌ䤤¹ç¤ï¤»¤Æ¤¯¤À¤µ¤¤.</p>',
+ => '<p>ǧ�ڤǤ��ޤ���Ǥ���.</p><p>�⤦���٥ꥯ�����Ȥ������������<a href="%s">������</a>�򥯥�å�.</p><p>���꤬��褷�ʤ����� <a href="mailto:%s">���Υ����Ȥδ����</a>���䤤��碌�Ƥ�������.</p>',
  CAS_STR_SERVICE_UNAVAILABLE
- => '¥µ¡¼¥Ó¥¹ `<b>%s</b>\' ¤ÏÍøÍѤǤ­¤Þ¤»¤ó (<b>%s</b>).'
+ => '�����ӥ� `<b>%s</b>\' �����ѤǤ��ޤ��� (<b>%s</b>).'
 );
 
 ?>
\ No newline at end of file
diff --git a/plugins/CasAuthentication/extlib/CAS/languages/languages.php b/plugins/CasAuthentication/extlib/CAS/languages/languages.php
index 001cfe445..2c6f8bb3b 100644
--- a/plugins/CasAuthentication/extlib/CAS/languages/languages.php
+++ b/plugins/CasAuthentication/extlib/CAS/languages/languages.php
@@ -1,24 +1,24 @@
-<?php
-
-/**
- * @file languages/languages.php
- * Internationalization constants
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- * @sa @link internalLang Internationalization @endlink
- * @ingroup internalLang
- */
-
-//@{
-/**
- * a phpCAS string index
- */
-define("CAS_STR_USING_SERVER",                1);
-define("CAS_STR_AUTHENTICATION_WANTED",       2);
-define("CAS_STR_LOGOUT",                      3);
-define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);
-define("CAS_STR_AUTHENTICATION_FAILED",       5);
-define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);
-define("CAS_STR_SERVICE_UNAVAILABLE",         7);
-//@}
-
+<?php

+

+/**

+ * @file languages/languages.php

+ * Internationalization constants

+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>

+ * @sa @link internalLang Internationalization @endlink

+ * @ingroup internalLang

+ */

+

+//@{

+/**

+ * a phpCAS string index

+ */

+define("CAS_STR_USING_SERVER",                1);

+define("CAS_STR_AUTHENTICATION_WANTED",       2);

+define("CAS_STR_LOGOUT",                      3);

+define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);

+define("CAS_STR_AUTHENTICATION_FAILED",       5);

+define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);

+define("CAS_STR_SERVICE_UNAVAILABLE",         7);

+//@}

+

 ?>
\ No newline at end of file
diff --git a/plugins/CasAuthentication/extlib/CAS/languages/spanish.php b/plugins/CasAuthentication/extlib/CAS/languages/spanish.php
index 04067ca03..3a8ffc253 100644
--- a/plugins/CasAuthentication/extlib/CAS/languages/spanish.php
+++ b/plugins/CasAuthentication/extlib/CAS/languages/spanish.php
@@ -1,27 +1,27 @@
-<?php
-
-/**
- * @file languages/spanish.php
- * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
- * @sa @link internalLang Internationalization @endlink
- * @ingroup internalLang
- */
-
-$this->_strings = array(
- CAS_STR_USING_SERVER 
- => 'usando servidor',
- CAS_STR_AUTHENTICATION_WANTED 
- => '¡Autentificación CAS necesaria!',
- CAS_STR_LOGOUT 
- => '¡Salida CAS necesaria!',
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
- => 'Ya debería haber sido redireccionado al servidor CAS. Haga click <a href="%s">aquí</a> para continuar.',
- CAS_STR_AUTHENTICATION_FAILED 
- => '¡Autentificación CAS fallida!',
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
- => '<p>No estás autentificado.</p><p>Puedes volver a intentarlo haciendo click <a href="%s">aquí</a>.</p><p>Si el problema persiste debería contactar con el <a href="mailto:%s">administrador de este sitio</a>.</p>',
- CAS_STR_SERVICE_UNAVAILABLE
- => 'El servicio `<b>%s</b>\' no está disponible (<b>%s</b>).'
-);
-
-?>
+<?php

+

+/**

+ * @file languages/spanish.php

+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>

+ * @sa @link internalLang Internationalization @endlink

+ * @ingroup internalLang

+ */

+

+$this->_strings = array(

+ CAS_STR_USING_SERVER 

+ => 'usando servidor',

+ CAS_STR_AUTHENTICATION_WANTED 

+ => '¡Autentificación CAS necesaria!',

+ CAS_STR_LOGOUT 

+ => '¡Salida CAS necesaria!',

+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 

+ => 'Ya debería haber sido redireccionado al servidor CAS. Haga click <a href="%s">aquí</a> para continuar.',

+ CAS_STR_AUTHENTICATION_FAILED 

+ => '¡Autentificación CAS fallida!',

+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 

+ => '<p>No estás autentificado.</p><p>Puedes volver a intentarlo haciendo click <a href="%s">aquí</a>.</p><p>Si el problema persiste debería contactar con el <a href="mailto:%s">administrador de este sitio</a>.</p>',

+ CAS_STR_SERVICE_UNAVAILABLE

+ => 'El servicio `<b>%s</b>\' no está disponible (<b>%s</b>).'

+);

+

+?>

diff --git a/plugins/Facebook/FacebookPlugin.php b/plugins/Facebook/FacebookPlugin.php
index 78c9054e1..5dba73a5d 100644
--- a/plugins/Facebook/FacebookPlugin.php
+++ b/plugins/Facebook/FacebookPlugin.php
@@ -22,7 +22,7 @@
  * @category  Plugin
  * @package   StatusNet
  * @author    Zach Copley <zach@status.net>
- * @copyright 2009 StatusNet, Inc.
+ * @copyright 2009-2010 StatusNet, Inc.
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  * @link      http://status.net/
  */
@@ -32,12 +32,12 @@ if (!defined('STATUSNET')) {
 }
 
 define("FACEBOOK_CONNECT_SERVICE", 3);
-define('FACEBOOKPLUGIN_VERSION', '0.9');
 
 require_once INSTALLDIR . '/plugins/Facebook/facebookutil.php';
 
 /**
- * Facebook plugin to add a StatusNet Facebook application
+ * Facebook plugin to add a StatusNet Facebook canvas application
+ * and allow registration and authentication via Facebook Connect
  *
  * @category Plugin
  * @package  StatusNet
@@ -49,6 +49,55 @@ require_once INSTALLDIR . '/plugins/Facebook/facebookutil.php';
 class FacebookPlugin extends Plugin
 {
 
+    const VERSION = STATUSNET_VERSION;
+
+    /**
+     * Initializer for the plugin.
+     */
+
+    function initialize()
+    {
+        // Allow the key and secret to be passed in
+        // Control panel will override
+
+        if (isset($this->apikey)) {
+            $key = common_config('facebook', 'apikey');
+            if (empty($key)) {
+                Config::save('facebook', 'apikey', $this->apikey);
+            }
+        }
+
+        if (isset($this->secret)) {
+            $secret = common_config('facebook', 'secret');
+            if (empty($secret)) {
+                Config::save(
+                    'facebook',
+                    'secret',
+                    $this->secret
+                );
+            }
+        }
+    }
+
+    /**
+     * Check to see if there is an API key and secret defined
+     * for Facebook integration.
+     *
+     * @return boolean result
+     */
+
+    static function hasKeys()
+    {
+        $apiKey    = common_config('facebook', 'apikey');
+        $apiSecret = common_config('facebook', 'secret');
+
+        if (!empty($apiKey) && !empty($apiSecret)) {
+            return true;
+        }
+
+        return false;
+    }
+
     /**
      * Add Facebook app actions to the router table
      *
@@ -61,22 +110,26 @@ class FacebookPlugin extends Plugin
 
     function onStartInitializeRouter($m)
     {
+        $m->connect('admin/facebook', array('action' => 'facebookadminpanel'));
 
-        // Facebook App stuff
+        if (self::hasKeys()) {
 
-        $m->connect('facebook/app', array('action' => 'facebookhome'));
-        $m->connect('facebook/app/index.php', array('action' => 'facebookhome'));
-        $m->connect('facebook/app/settings.php',
-                    array('action' => 'facebooksettings'));
-        $m->connect('facebook/app/invite.php', array('action' => 'facebookinvite'));
-        $m->connect('facebook/app/remove', array('action' => 'facebookremove'));
+            // Facebook App stuff
 
-        // Facebook Connect stuff
+            $m->connect('facebook/app', array('action' => 'facebookhome'));
+            $m->connect('facebook/app/index.php', array('action' => 'facebookhome'));
+            $m->connect('facebook/app/settings.php',
+                        array('action' => 'facebooksettings'));
+            $m->connect('facebook/app/invite.php', array('action' => 'facebookinvite'));
+            $m->connect('facebook/app/remove', array('action' => 'facebookremove'));
 
-        $m->connect('main/facebookconnect', array('action' => 'FBConnectAuth'));
-        $m->connect('main/facebooklogin', array('action' => 'FBConnectLogin'));
-        $m->connect('settings/facebook', array('action' => 'FBConnectSettings'));
-        $m->connect('xd_receiver.html', array('action' => 'FBC_XDReceiver'));
+            // Facebook Connect stuff
+
+            $m->connect('main/facebookconnect', array('action' => 'FBConnectAuth'));
+            $m->connect('main/facebooklogin', array('action' => 'FBConnectLogin'));
+            $m->connect('settings/facebook', array('action' => 'FBConnectSettings'));
+            $m->connect('xd_receiver.html', array('action' => 'FBC_XDReceiver'));
+        }
 
         return true;
     }
@@ -98,6 +151,7 @@ class FacebookPlugin extends Plugin
         case 'FacebookinviteAction':
         case 'FacebookremoveAction':
         case 'FacebooksettingsAction':
+        case 'FacebookadminpanelAction':
             include_once INSTALLDIR . '/plugins/Facebook/' .
               strtolower(mb_substr($cls, 0, -6)) . '.php';
             return false;
@@ -123,6 +177,32 @@ class FacebookPlugin extends Plugin
     }
 
     /**
+     * Add a Facebook tab to the admin panels
+     *
+     * @param Widget $nav Admin panel nav
+     *
+     * @return boolean hook value
+     */
+
+    function onEndAdminPanelNav($nav)
+    {
+        if (AdminPanelAction::canAdmin('facebook')) {
+
+            $action_name = $nav->action->trimmed('action');
+
+            $nav->out->menuItem(
+                common_local_url('facebookadminpanel'),
+                _m('Facebook'),
+                _m('Facebook integration configuration'),
+                $action_name == 'facebookadminpanel',
+                'nav_facebook_admin_panel'
+            );
+        }
+
+        return true;
+    }
+
+    /**
      * Override normal HTML output to force the content type to
      * text/html and add in xmlns:fb
      *
@@ -280,6 +360,9 @@ class FacebookPlugin extends Plugin
 
     function reqFbScripts($action)
     {
+        if (!self::hasKeys()) {
+            return false;
+        }
 
         // If you're logged in w/FB Connect, you always need the FB stuff
 
@@ -352,44 +435,35 @@ class FacebookPlugin extends Plugin
 
     function onStartPrimaryNav($action)
     {
-        $user = common_current_user();
+        if (self::hasKeys()) {
+            $user = common_current_user();
+            if (!empty($user)) {
 
-        $connect = 'FBConnectSettings';
-        if (common_config('xmpp', 'enabled')) {
-            $connect = 'imsettings';
-        } else if (common_config('sms', 'enabled')) {
-            $connect = 'smssettings';
-        } else if (common_config('twitter', 'enabled')) {
-            $connect = 'twittersettings';
-        }
-
-        if (!empty($user)) {
-
-            $fbuid = $this->loggedIn();
-
-            if (!empty($fbuid)) {
+                $fbuid = $this->loggedIn();
 
-                /* Default FB silhouette pic for FB users who haven't
-                   uploaded a profile pic yet. */
+                if (!empty($fbuid)) {
 
-                $silhouetteUrl =
-                    'http://static.ak.fbcdn.net/pics/q_silhouette.gif';
+                    /* Default FB silhouette pic for FB users who haven't
+                       uploaded a profile pic yet. */
 
-                $url = $this->getProfilePicURL($fbuid);
+                    $silhouetteUrl =
+                        'http://static.ak.fbcdn.net/pics/q_silhouette.gif';
 
-                $action->elementStart('li', array('id' => 'nav_fb'));
+                    $url = $this->getProfilePicURL($fbuid);
 
-                $action->element('img', array('id' => 'fbc_profile-pic',
-                    'src' => (!empty($url)) ? $url : $silhouetteUrl,
-                    'alt' => 'Facebook Connect User',
-                    'width' => '16'), '');
+                    $action->elementStart('li', array('id' => 'nav_fb'));
 
-                $iconurl =  common_path('plugins/Facebook/fbfavicon.ico');
-                $action->element('img', array('id' => 'fb_favicon',
-                    'src' => $iconurl));
+                    $action->element('img', array('id' => 'fbc_profile-pic',
+                        'src' => (!empty($url)) ? $url : $silhouetteUrl,
+                        'alt' => 'Facebook Connect User',
+                        'width' => '16'), '');
 
-                $action->elementEnd('li');
+                    $iconurl =  common_path('plugins/Facebook/fbfavicon.ico');
+                    $action->element('img', array('id' => 'fb_favicon',
+                        'src' => $iconurl));
 
+                    $action->elementEnd('li');
+                }
             }
         }
 
@@ -406,14 +480,15 @@ class FacebookPlugin extends Plugin
 
     function onEndLoginGroupNav(&$action)
     {
+        if (self::hasKeys()) {
 
-        $action_name = $action->trimmed('action');
-
-        $action->menuItem(common_local_url('FBConnectLogin'),
-                                           _m('Facebook'),
-                                           _m('Login or register using Facebook'),
-                                           'FBConnectLogin' === $action_name);
+            $action_name = $action->trimmed('action');
 
+            $action->menuItem(common_local_url('FBConnectLogin'),
+                                               _m('Facebook'),
+                                               _m('Login or register using Facebook'),
+                                               'FBConnectLogin' === $action_name);
+        }
         return true;
     }
 
@@ -427,13 +502,15 @@ class FacebookPlugin extends Plugin
 
     function onEndConnectSettingsNav(&$action)
     {
-        $action_name = $action->trimmed('action');
+        if (self::hasKeys()) {
 
-        $action->menuItem(common_local_url('FBConnectSettings'),
-                          _m('Facebook'),
-                          _m('Facebook Connect Settings'),
-                          $action_name === 'FBConnectSettings');
+            $action_name = $action->trimmed('action');
 
+            $action->menuItem(common_local_url('FBConnectSettings'),
+                              _m('Facebook'),
+                              _m('Facebook Connect Settings'),
+                              $action_name === 'FBConnectSettings');
+        }
         return true;
     }
 
@@ -447,20 +524,22 @@ class FacebookPlugin extends Plugin
 
     function onStartLogout($action)
     {
-        $action->logout();
-        $fbuid = $this->loggedIn();
+        if (self::hasKeys()) {
 
-        if (!empty($fbuid)) {
-            try {
-                $facebook = getFacebook();
-                $facebook->expire_session();
-            } catch (Exception $e) {
-                common_log(LOG_WARNING, 'Facebook Connect Plugin - ' .
-                           'Could\'t logout of Facebook: ' .
-                           $e->getMessage());
+            $action->logout();
+            $fbuid = $this->loggedIn();
+
+            if (!empty($fbuid)) {
+                try {
+                    $facebook = getFacebook();
+                    $facebook->expire_session();
+                } catch (Exception $e) {
+                    common_log(LOG_WARNING, 'Facebook Connect Plugin - ' .
+                               'Could\'t logout of Facebook: ' .
+                               $e->getMessage());
+                }
             }
         }
-
         return true;
     }
 
@@ -506,7 +585,9 @@ class FacebookPlugin extends Plugin
 
     function onStartEnqueueNotice($notice, &$transports)
     {
-        array_push($transports, 'facebook');
+        if (self::hasKeys()) {
+            array_push($transports, 'facebook');
+        }
         return true;
     }
 
@@ -519,21 +600,26 @@ class FacebookPlugin extends Plugin
      */
     function onEndInitializeQueueManager($manager)
     {
-        $manager->connect('facebook', 'FacebookQueueHandler');
+        if (self::hasKeys()) {
+            $manager->connect('facebook', 'FacebookQueueHandler');
+        }
         return true;
     }
 
     function onPluginVersion(&$versions)
     {
-        $versions[] = array('name' => 'Facebook',
-                            'version' => FACEBOOKPLUGIN_VERSION,
-                            'author' => 'Zach Copley',
-                            'homepage' => 'http://status.net/wiki/Plugin:Facebook',
-                            'rawdescription' =>
-                            _m('The Facebook plugin allows you to integrate ' .
-                               'your StatusNet instance with ' .
-                               '<a href="http://facebook.com/">Facebook</a> ' .
-                               'and Facebook Connect.'));
+        $versions[] = array(
+            'name' => 'Facebook',
+            'version' => self::VERSION,
+            'author' => 'Zach Copley',
+            'homepage' => 'http://status.net/wiki/Plugin:Facebook',
+            'rawdescription' => _m(
+                'The Facebook plugin allows you to integrate ' .
+                'your StatusNet instance with ' .
+                '<a href="http://facebook.com/">Facebook</a> ' .
+                'and Facebook Connect.'
+            )
+        );
         return true;
     }
 
diff --git a/plugins/Facebook/README b/plugins/Facebook/README
index bf2f4a180..14c1d3241 100644
--- a/plugins/Facebook/README
+++ b/plugins/Facebook/README
@@ -1,6 +1,9 @@
-This plugin allows you to use Facebook Connect with StatusNet, provides a
-Facebook application for your users, and allows them to update their
-Facebook statuses from StatusNet.
+Facebook Plugin
+===============
+
+This plugin allows you to use Facebook Connect with StatusNet, provides
+a Facebook canvas application for your users, and allows them to update
+their Facebook statuses from StatusNet.
 
 Facebook Connect
 ----------------
@@ -15,12 +18,12 @@ Facebook credentials. With Facebook Connect, your users can:
 Built-in Facebook Application
 -----------------------------
 
-The plugin also installs a StatusNet Facebook application that allows your
-users to automatically update their Facebook statuses with their latest
-notices, invite their friends to use the app (and thus your site), view
-their notice timelines, and post notices -- all from within Facebook. The
-application is built into the StatusNet Facebook plugin and runs on your
-host.
+The plugin also installs a StatusNet Facebook canvas application that
+allows your users to automatically update their Facebook status with
+their latest notices, invite their friends to use the app (and thus your
+site), view their notice timelines and post notices -- all from within
+Facebook.  The application is built into the StatusNet Facebook plugin
+and runs on your host.
 
 Quick setup instructions*
 -------------------------
@@ -29,13 +32,9 @@ Install the Facebook Developer application on Facebook:
 
     http://www.facebook.com/developers/
 
-Use it to create a new application and generate an API key and secret. Add a
-Facebook app section of your config.php and copy in the key and secret,
-e.g.:
-
-    // Config section for the built-in Facebook application
-    $config['facebook']['apikey'] = 'APIKEY';
-    $config['facebook']['secret'] = 'SECRET';
+Use it to create a new application and generate an API key and secret.
+You will need the key and secret so cut-n-paste them into your text
+editor or write them down.
 
 In Facebook's application editor, specify the following URLs for your app:
 
@@ -67,11 +66,36 @@ can be left with default values.
     http://wiki.developers.facebook.com/index.php/Connect/Setting_Up_Your_Site
     http://wiki.developers.facebook.com/index.php/Creating_your_first_application
 
-Finally you must activate the plugin by adding the following line to your
-config.php:
+Finally you must activate the plugin by adding it in your config.php
+(this is where you'll need the API key and secret generated earlier):
+
+    addPlugin(
+        'Facebook',
+        array(
+            'apikey' => 'YOUR_APIKEY',
+            'secret' => 'YOUR_SECRET'
+        )
+    );
+
+Administration Panel
+--------------------
+
+As of StatusNet 0.9.0 you can alternatively specify the key and secret
+via a Facebook administration panel from within StatusNet, in which case
+you can just add:
 
     addPlugin('Facebook');
 
+to activate the plugin.
+
+NOTE: To enable the administration panel you'll need to add it to the
+list of active administration panels, e.g.:
+
+    $config['admin']['panels'][] = 'facebook';
+
+and of course you'll need a user with the administrative role to access
+it and input the API key and secret (see: scripts/userrole.php).
+
 Testing It Out
 --------------
 
@@ -81,11 +105,11 @@ disconnect* to their Facebook accounts from it.
 
 To try out the plugin, fire up your browser and connect to:
 
-    http://SITE/PATH_TO_STATUSNET/main/facebooklogin
+    http://example.net/mublog/main/facebooklogin
 
 or, if you do not have fancy URLs turned on:
 
-    http://SITE/PATH_TO_STATUSNET/index.php/main/facebooklogin
+    http://example.net/mublog/index.php/main/facebooklogin
 
 You should see a page with a blue button that says: "Connect with Facebook"
 and you should be able to login or register.
@@ -101,7 +125,7 @@ the app, you are given the option to update their Facebook status via
 StatusNet.
 
 * Note: Before a user can disconnect from Facebook, she must set a normal
-  StatusNet password. Otherwise, she might not be able to login in to her
+  StatusNet password.  Otherwise, she might not be able to login in to her
   account in the future.  This is usually only required for users who have
   used Facebook Connect to register their StatusNet account, and therefore
   haven't already set a local password.
@@ -109,16 +133,20 @@ StatusNet.
 Offline Queue Handling
 ----------------------
 
-For larger sites needing better performance it's possible to enable queuing
-and have users' notices posted to Facebook via a separate "offline"
-FacebookQueueHandler (facebookqueuhandler.php in the Facebook plugin
-directory), which will be started by the plugin along with their other
-daemons when you run scripts/startdaemons.sh. See the StatusNet README for
-more about queuing and daemons.
+For larger sites needing better performance it's possible to enable
+queuing and have users' notices posted to Facebook via a separate
+"offline" process -- FacebookQueueHandler (facebookqueuhandler.php in
+the Facebook plugin directory).  It will run automatically if you have
+enabled StatusNet's offline queueing subsystem.  See the "Queues and
+daemons" section in the StatusNet README for more about queuing.
+
 
 TODO
 ----
 
+- Make Facebook Connect work for authentication for multi-site setups
+  (e.g.: *.status.net)
+- Posting to Facebook user streams using only Facebook Connect
 - Invite Facebook friends to use your StatusNet installation via Facebook
   Connect
 - Auto-subscribe Facebook friends already using StatusNet
@@ -126,4 +154,4 @@ TODO
 - Allow users to update their Facebook statuses once they have authenticated
   with Facebook Connect (no need for them to use the Facebook app if they
   don't want to).
-- Re-design the whole thing to support multiple instances of StatusNet
+- Import a user's Facebook updates into StatusNet
diff --git a/plugins/Facebook/facebookadminpanel.php b/plugins/Facebook/facebookadminpanel.php
new file mode 100644
index 000000000..ae1c7302f
--- /dev/null
+++ b/plugins/Facebook/facebookadminpanel.php
@@ -0,0 +1,223 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Facebook integration administration panel
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Settings
+ * @package   StatusNet
+ * @author    Zach Copley <zach@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * Administer global Facebook integration settings
+ *
+ * @category Admin
+ * @package  StatusNet
+ * @author   Zach Copley <zach@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link     http://status.net/
+ */
+
+class FacebookadminpanelAction extends AdminPanelAction
+{
+    /**
+     * Returns the page title
+     *
+     * @return string page title
+     */
+
+    function title()
+    {
+        return _m('Facebook');
+    }
+
+    /**
+     * Instructions for using this form.
+     *
+     * @return string instructions
+     */
+
+    function getInstructions()
+    {
+        return _m('Facebook integration settings');
+    }
+
+    /**
+     * Show the Facebook admin panel form
+     *
+     * @return void
+     */
+
+    function showForm()
+    {
+        $form = new FacebookAdminPanelForm($this);
+        $form->show();
+        return;
+    }
+
+    /**
+     * Save settings from the form
+     *
+     * @return void
+     */
+
+    function saveSettings()
+    {
+        static $settings = array(
+            'facebook'     => array('apikey', 'secret'),
+        );
+
+        $values = array();
+
+        foreach ($settings as $section => $parts) {
+            foreach ($parts as $setting) {
+                $values[$section][$setting]
+                    = $this->trimmed($setting);
+            }
+        }
+
+        // This throws an exception on validation errors
+
+        $this->validate($values);
+
+        // assert(all values are valid);
+
+        $config = new Config();
+
+        $config->query('BEGIN');
+
+        foreach ($settings as $section => $parts) {
+            foreach ($parts as $setting) {
+                Config::save($section, $setting, $values[$section][$setting]);
+            }
+        }
+
+        $config->query('COMMIT');
+
+        return;
+    }
+
+    function validate(&$values)
+    {
+        // Validate consumer key and secret (can't be too long)
+
+        if (mb_strlen($values['facebook']['apikey']) > 255) {
+            $this->clientError(
+                _m("Invalid Facebook API key. Max length is 255 characters.")
+            );
+        }
+
+        if (mb_strlen($values['facebook']['secret']) > 255) {
+            $this->clientError(
+                _m("Invalid Facebook API secret. Max length is 255 characters.")
+            );
+        }
+    }
+}
+
+class FacebookAdminPanelForm extends AdminForm
+{
+    /**
+     * ID of the form
+     *
+     * @return int ID of the form
+     */
+
+    function id()
+    {
+        return 'facebookadminpanel';
+    }
+
+    /**
+     * class of the form
+     *
+     * @return string class of the form
+     */
+
+    function formClass()
+    {
+        return 'form_settings';
+    }
+
+    /**
+     * Action of the form
+     *
+     * @return string URL of the action
+     */
+
+    function action()
+    {
+        return common_local_url('facebookadminpanel');
+    }
+
+    /**
+     * Data elements of the form
+     *
+     * @return void
+     */
+
+    function formData()
+    {
+        $this->out->elementStart(
+            'fieldset',
+            array('id' => 'settings_facebook-application')
+        );
+        $this->out->element('legend', null, _m('Facebook application settings'));
+        $this->out->elementStart('ul', 'form_data');
+
+        $this->li();
+        $this->input(
+            'apikey',
+            _m('API key'),
+            _m('API key provided by Facebook'),
+            'facebook'
+        );
+        $this->unli();
+
+        $this->li();
+        $this->input(
+            'secret',
+             _m('Secret'),
+            _m('API secret provided by Facebook'),
+            'facebook'
+        );
+        $this->unli();
+
+        $this->out->elementEnd('ul');
+        $this->out->elementEnd('fieldset');
+    }
+
+    /**
+     * Action elements
+     *
+     * @return void
+     */
+
+    function formActions()
+    {
+        $this->out->submit('submit', _('Save'), 'submit', null, _('Save Facebook settings'));
+    }
+}
diff --git a/plugins/Facebook/locale/Facebook.po b/plugins/Facebook/locale/Facebook.po
index 5b313c8c5..4bc00248c 100644
--- a/plugins/Facebook/locale/Facebook.po
+++ b/plugins/Facebook/locale/Facebook.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2009-12-07 20:38-0800\n"
+"POT-Creation-Date: 2010-03-01 14:58-0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -59,63 +59,31 @@ msgstr ""
 msgid "Lost or forgotten password?"
 msgstr ""
 
-#: facebookaction.php:386 facebookhome.php:248
+#: facebookaction.php:330 facebookhome.php:248
 msgid "Pagination"
 msgstr ""
 
-#: facebookaction.php:395 facebookhome.php:257
+#: facebookaction.php:339 facebookhome.php:257
 msgid "After"
 msgstr ""
 
-#: facebookaction.php:403 facebookhome.php:265
+#: facebookaction.php:347 facebookhome.php:265
 msgid "Before"
 msgstr ""
 
-#: facebookaction.php:421
+#: facebookaction.php:365
 msgid "No notice content!"
 msgstr ""
 
-#: facebookaction.php:427
+#: facebookaction.php:371
 #, php-format
 msgid "That's too long. Max notice size is %d chars."
 msgstr ""
 
-#: facebookaction.php:523
+#: facebookaction.php:430
 msgid "Notices"
 msgstr ""
 
-#: facebookutil.php:280
-#, php-format
-msgid "Your %1$s Facebook application access has been disabled."
-msgstr ""
-
-#: facebookutil.php:283
-#, php-format
-msgid ""
-"Hi, %1$s. We're sorry to inform you that we are unable to update your "
-"Facebook status from %2$s, and have disabled the Facebook application for "
-"your account. This may be because you have removed the Facebook "
-"application's authorization, or have deleted your Facebook account.  You can "
-"re-enable the Facebook application and automatic status updating by re-"
-"installing the %2$s Facebook application.\n"
-"\n"
-"Regards,\n"
-"\n"
-"%2$s"
-msgstr ""
-
-#: FBConnectLogin.php:33
-msgid "Already logged in."
-msgstr ""
-
-#: FBConnectLogin.php:41
-msgid "Login with your Facebook Account"
-msgstr ""
-
-#: FBConnectLogin.php:55
-msgid "Facebook Login"
-msgstr ""
-
 #: facebookhome.php:111
 msgid "Server error - couldn't get user!"
 msgstr ""
@@ -149,50 +117,6 @@ msgstr ""
 msgid "Skip"
 msgstr ""
 
-#: facebooksettings.php:74
-msgid "There was a problem saving your sync preferences!"
-msgstr ""
-
-#: facebooksettings.php:76
-msgid "Sync preferences saved."
-msgstr ""
-
-#: facebooksettings.php:99
-msgid "Automatically update my Facebook status with my notices."
-msgstr ""
-
-#: facebooksettings.php:106
-msgid "Send \"@\" replies to Facebook."
-msgstr ""
-
-#: facebooksettings.php:115
-msgid "Prefix"
-msgstr ""
-
-#: facebooksettings.php:117
-msgid "A string to prefix notices with."
-msgstr ""
-
-#: facebooksettings.php:123
-msgid "Save"
-msgstr ""
-
-#: facebooksettings.php:133
-#, php-format
-msgid ""
-"If you would like %s to automatically update your Facebook status with your "
-"latest notice, you need to give it permission."
-msgstr ""
-
-#: facebooksettings.php:146
-#, php-format
-msgid "Allow %s to update my Facebook status"
-msgstr ""
-
-#: facebooksettings.php:156
-msgid "Sync preferences"
-msgstr ""
-
 #: facebookinvite.php:72
 #, php-format
 msgid "Thanks for inviting your friends to use %s"
@@ -221,61 +145,85 @@ msgstr ""
 msgid "Send invitations"
 msgstr ""
 
-#: facebookremove.php:58
-msgid "Couldn't remove Facebook user."
+#: FacebookPlugin.php:413 FacebookPlugin.php:433
+msgid "Facebook"
 msgstr ""
 
-#: FBConnectSettings.php:56 FacebookPlugin.php:430
+#: FacebookPlugin.php:414
+msgid "Login or register using Facebook"
+msgstr ""
+
+#: FacebookPlugin.php:434 FBConnectSettings.php:56
 msgid "Facebook Connect Settings"
 msgstr ""
 
-#: FBConnectSettings.php:67
-msgid "Manage how your account connects to Facebook"
+#: FacebookPlugin.php:533
+msgid ""
+"The Facebook plugin allows you to integrate your StatusNet instance with <a "
+"href=\"http://facebook.com/\">Facebook</a> and Facebook Connect."
 msgstr ""
 
-#: FBConnectSettings.php:92
-msgid "There is no Facebook user connected to this account."
+#: facebookremove.php:58
+msgid "Couldn't remove Facebook user."
 msgstr ""
 
-#: FBConnectSettings.php:100
-msgid "Connected Facebook user"
+#: facebooksettings.php:74
+msgid "There was a problem saving your sync preferences!"
 msgstr ""
 
-#: FBConnectSettings.php:119
-msgid "Disconnect my account from Facebook"
+#: facebooksettings.php:76
+msgid "Sync preferences saved."
 msgstr ""
 
-#: FBConnectSettings.php:124
-msgid ""
-"Disconnecting your Faceboook would make it impossible to log in! Please "
+#: facebooksettings.php:99
+msgid "Automatically update my Facebook status with my notices."
 msgstr ""
 
-#: FBConnectSettings.php:128
-msgid "set a password"
+#: facebooksettings.php:106
+msgid "Send \"@\" replies to Facebook."
 msgstr ""
 
-#: FBConnectSettings.php:130
-msgid " first."
+#: facebooksettings.php:115
+msgid "Prefix"
 msgstr ""
 
-#: FBConnectSettings.php:142
-msgid "Disconnect"
+#: facebooksettings.php:117
+msgid "A string to prefix notices with."
 msgstr ""
 
-#: FBConnectSettings.php:164 FBConnectAuth.php:90
-msgid "There was a problem with your session token. Try again, please."
+#: facebooksettings.php:123
+msgid "Save"
 msgstr ""
 
-#: FBConnectSettings.php:178
-msgid "Couldn't delete link to Facebook."
+#: facebooksettings.php:133
+#, php-format
+msgid ""
+"If you would like %s to automatically update your Facebook status with your "
+"latest notice, you need to give it permission."
 msgstr ""
 
-#: FBConnectSettings.php:194
-msgid "You have disconnected from Facebook."
+#: facebooksettings.php:146
+#, php-format
+msgid "Allow %s to update my Facebook status"
 msgstr ""
 
-#: FBConnectSettings.php:197
-msgid "Not sure what you're trying to do."
+#: facebooksettings.php:156
+msgid "Sync preferences"
+msgstr ""
+
+#: facebookutil.php:285
+#, php-format
+msgid ""
+"Hi, %1$s. We're sorry to inform you that we are unable to update your "
+"Facebook status from %2$s, and have disabled the Facebook application for "
+"your account. This may be because you have removed the Facebook "
+"application's authorization, or have deleted your Facebook account.  You can "
+"re-enable the Facebook application and automatic status updating by re-"
+"installing the %2$s Facebook application.\n"
+"\n"
+"Regards,\n"
+"\n"
+"%2$s"
 msgstr ""
 
 #: FBConnectAuth.php:51
@@ -286,6 +234,10 @@ msgstr ""
 msgid "There is already a local user linked with this Facebook."
 msgstr ""
 
+#: FBConnectAuth.php:90 FBConnectSettings.php:164
+msgid "There was a problem with your session token. Try again, please."
+msgstr ""
+
 #: FBConnectAuth.php:95
 msgid "You can't register if you don't agree to the license."
 msgstr ""
@@ -385,10 +337,59 @@ msgstr ""
 msgid "Invalid username or password."
 msgstr ""
 
-#: FacebookPlugin.php:409 FacebookPlugin.php:429
-msgid "Facebook"
+#: FBConnectLogin.php:33
+msgid "Already logged in."
 msgstr ""
 
-#: FacebookPlugin.php:410
-msgid "Login or register using Facebook"
+#: FBConnectLogin.php:41
+msgid "Login with your Facebook Account"
+msgstr ""
+
+#: FBConnectLogin.php:55
+msgid "Facebook Login"
+msgstr ""
+
+#: FBConnectSettings.php:67
+msgid "Manage how your account connects to Facebook"
+msgstr ""
+
+#: FBConnectSettings.php:92
+msgid "There is no Facebook user connected to this account."
+msgstr ""
+
+#: FBConnectSettings.php:100
+msgid "Connected Facebook user"
+msgstr ""
+
+#: FBConnectSettings.php:119
+msgid "Disconnect my account from Facebook"
+msgstr ""
+
+#: FBConnectSettings.php:124
+msgid ""
+"Disconnecting your Faceboook would make it impossible to log in! Please "
+msgstr ""
+
+#: FBConnectSettings.php:128
+msgid "set a password"
+msgstr ""
+
+#: FBConnectSettings.php:130
+msgid " first."
+msgstr ""
+
+#: FBConnectSettings.php:142
+msgid "Disconnect"
+msgstr ""
+
+#: FBConnectSettings.php:178
+msgid "Couldn't delete link to Facebook."
+msgstr ""
+
+#: FBConnectSettings.php:194
+msgid "You have disconnected from Facebook."
+msgstr ""
+
+#: FBConnectSettings.php:197
+msgid "Not sure what you're trying to do."
 msgstr ""
diff --git a/plugins/Gravatar/locale/Gravatar.po b/plugins/Gravatar/locale/Gravatar.po
index 1df62b666..d7275b929 100644
--- a/plugins/Gravatar/locale/Gravatar.po
+++ b/plugins/Gravatar/locale/Gravatar.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2009-12-11 16:27-0800\n"
+"POT-Creation-Date: 2010-03-01 14:58-0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -59,3 +59,9 @@ msgstr ""
 #: GravatarPlugin.php:177
 msgid "Gravatar removed."
 msgstr ""
+
+#: GravatarPlugin.php:196
+msgid ""
+"The Gravatar plugin allows users to use their <a href=\"http://www.gravatar."
+"com/\">Gravatar</a> with StatusNet."
+msgstr ""
diff --git a/plugins/LdapAuthentication/LdapAuthenticationPlugin.php b/plugins/LdapAuthentication/LdapAuthenticationPlugin.php
index 768f0fe7f..483209676 100644
--- a/plugins/LdapAuthentication/LdapAuthenticationPlugin.php
+++ b/plugins/LdapAuthentication/LdapAuthenticationPlugin.php
@@ -76,6 +76,32 @@ class LdapAuthenticationPlugin extends AuthenticationPlugin
             return false;
         }
     }
+
+    function onEndShowPageNotice($action)
+    {
+        $name = $action->trimmed('action');
+        $instr = false;
+
+        switch ($name)
+        {
+         case 'register':
+            if($this->autoregistration) {
+                $instr = 'Have an LDAP account? Use your standard username and password.';
+            }
+            break;
+         case 'login':
+            $instr = 'Have an LDAP account? Use your standard username and password.';
+            break;
+         default:
+            return true;
+        }
+
+        if($instr) {
+            $output = common_markup_to_html($instr);
+            $action->raw($output);
+        }
+        return true;
+    }
     
     //---interface implementation---//
 
@@ -163,15 +189,14 @@ class LdapAuthenticationPlugin extends AuthenticationPlugin
         $entry = $this->ldap_get_user($username, $this->attributes);
         if(!$entry){
             //this really shouldn't happen
-            return $username;
+            $nickname = $username;
         }else{
             $nickname = $entry->getValue($this->attributes['nickname'],'single');
-            if($nickname){
-                return $nickname;
-            }else{
-                return $username;
+            if(!$nickname){
+                $nickname = $username;
             }
         }
+        return common_nicknamize($nickname);
     }
     
     //---utility functions---//
@@ -199,8 +224,12 @@ class LdapAuthenticationPlugin extends AuthenticationPlugin
         $ldap->setErrorHandling(PEAR_ERROR_RETURN);
         $err=$ldap->bind();
         if (Net_LDAP2::isError($err)) {
-            common_log(LOG_WARNING, 'Could not connect to LDAP server: '.$err->getMessage());
-            return false;
+            // if we were called with a config, assume caller will handle
+            // incorrect username/password (LDAP_INVALID_CREDENTIALS)
+            if (isset($config) && $err->getCode() == 0x31) {
+                return null;
+            }
+            throw new Exception('Could not connect to LDAP server: '.$err->getMessage());
         }
         if($config == null) $this->default_ldap=$ldap;
 
diff --git a/plugins/LdapAuthentication/README b/plugins/LdapAuthentication/README
index 0460fb639..c188f2dbc 100644
--- a/plugins/LdapAuthentication/README
+++ b/plugins/LdapAuthentication/README
@@ -9,7 +9,10 @@ to the bottom of your config.php
 
 Settings
 ========
-provider_name*: a unique name for this authentication provider.
+provider_name*: This is a identifier designated to the connection.
+    It's how StatusNet will refer to the authentication source.
+    For the most part, any name can be used, so long as each authentication source has a different identifier.
+    In most cases there will be only one authentication source used.
 authoritative (false): Set to true if LDAP's responses are authoritative
     (if authorative and LDAP fails, no other password checking will be done).
 autoregistration (false): Set to true if users should be automatically created
diff --git a/plugins/LdapAuthorization/LdapAuthorizationPlugin.php b/plugins/LdapAuthorization/LdapAuthorizationPlugin.php
index 7f48ce5e1..2608025dd 100644
--- a/plugins/LdapAuthorization/LdapAuthorizationPlugin.php
+++ b/plugins/LdapAuthorization/LdapAuthorizationPlugin.php
@@ -167,7 +167,12 @@ class LdapAuthorizationPlugin extends AuthorizationPlugin
         $ldap->setErrorHandling(PEAR_ERROR_RETURN);
         $err=$ldap->bind();
         if (Net_LDAP2::isError($err)) {
-            common_log(LOG_WARNING, 'Could not connect to LDAP server: '.$err->getMessage());
+            // if we were called with a config, assume caller will handle
+            // incorrect username/password (LDAP_INVALID_CREDENTIALS)
+            if (isset($config) && $err->getCode() == 0x31) {
+                return null;
+            }
+            throw new Exception('Could not connect to LDAP server: '.$err->getMessage());
             return false;
         }
         if($config == null) $this->default_ldap=$ldap;
@@ -185,6 +190,9 @@ class LdapAuthorizationPlugin extends AuthorizationPlugin
         if($ldap==null) {
             $ldap = $this->ldap_get_connection();
         }
+        if(! $ldap) {
+            throw new Exception("Could not connect to LDAP");
+        }
         $filter = Net_LDAP2_Filter::create($this->attributes['username'], 'equals',  $username);
         $options = array(
             'attributes' => $attributes
diff --git a/plugins/LdapAuthorization/README b/plugins/LdapAuthorization/README
index 44239d8e0..3a6d8d25e 100644
--- a/plugins/LdapAuthorization/README
+++ b/plugins/LdapAuthorization/README
@@ -11,7 +11,10 @@ You *cannot* use this plugin without the LDAP Authentication plugin
 
 Settings
 ========
-provider_name*: name of the LDAP authentication provider that this plugin works with.
+provider_name*: This is a identifier designated to the connection.
+    It's how StatusNet will refer to the authentication source.
+    For the most part, any name can be used, so long as each authentication source has a different identifier.
+    In most cases there will be only one authentication source used.
 authoritative (false): should this plugin be authoritative for
     authorization?
 uniqueMember_attribute ('uniqueMember')*: the attribute of a group
diff --git a/plugins/Mapstraction/locale/Mapstraction.po b/plugins/Mapstraction/locale/Mapstraction.po
index c1c50bf50..1dd5dbbcc 100644
--- a/plugins/Mapstraction/locale/Mapstraction.po
+++ b/plugins/Mapstraction/locale/Mapstraction.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2009-12-07 20:38-0800\n"
+"POT-Creation-Date: 2010-03-01 14:58-0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -34,15 +34,21 @@ msgstr ""
 msgid "User has no profile."
 msgstr ""
 
-#: usermap.php:71
-#, php-format
-msgid "%s map, page %d"
-msgstr ""
-
-#: MapstractionPlugin.php:180
+#: MapstractionPlugin.php:182
 msgid "Map"
 msgstr ""
 
-#: MapstractionPlugin.php:191
+#: MapstractionPlugin.php:193
 msgid "Full size"
 msgstr ""
+
+#: MapstractionPlugin.php:205
+msgid ""
+"Show maps of users' and friends' notices with <a href=\"http://www."
+"mapstraction.com/\">Mapstraction</a> JavaScript library."
+msgstr ""
+
+#: usermap.php:71
+#, php-format
+msgid "%s map, page %d"
+msgstr ""
diff --git a/plugins/Mapstraction/map.php b/plugins/Mapstraction/map.php
index a33dfc736..b809c1b8e 100644
--- a/plugins/Mapstraction/map.php
+++ b/plugins/Mapstraction/map.php
@@ -142,8 +142,6 @@ class MapAction extends OwnerDesignAction
         // of refactoring from within a plugin, so I'm just abusing
         // the ApiAction method. Don't do this unless you're me!
 
-        require_once(INSTALLDIR.'/lib/api.php');
-
         $act = new ApiAction('/dev/null');
 
         $arr = $act->twitterStatusArray($notice, true);
diff --git a/plugins/MemcachedPlugin.php b/plugins/MemcachedPlugin.php
new file mode 100644
index 000000000..707e6db9a
--- /dev/null
+++ b/plugins/MemcachedPlugin.php
@@ -0,0 +1,223 @@
+<?php
+/**
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2009, StatusNet, Inc.
+ *
+ * Plugin to implement cache interface for memcached
+ *
+ * PHP version 5
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Cache
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>, Craig Andrews <candrews@integralblue.com>
+ * @copyright 2009 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    // This check helps protect against security problems;
+    // your code file can't be executed directly from the web.
+    exit(1);
+}
+
+/**
+ * A plugin to use memcached for the cache interface
+ *
+ * This used to be encoded as config-variable options in the core code;
+ * it's now broken out to a separate plugin. The same interface can be
+ * implemented by other plugins.
+ *
+ * @category  Cache
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>, Craig Andrews <candrews@integralblue.com>
+ * @copyright 2009 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+class MemcachedPlugin extends Plugin
+{
+    static $cacheInitialized = false;
+
+    private $_conn  = null;
+    public $servers = array('127.0.0.1;11211');
+
+    public $defaultExpiry = 86400; // 24h
+
+    /**
+     * Initialize the plugin
+     *
+     * Note that onStartCacheGet() may have been called before this!
+     *
+     * @return boolean flag value
+     */
+
+    function onInitializePlugin()
+    {
+        $this->_ensureConn();
+        self::$cacheInitialized = true;
+        return true;
+    }
+
+    /**
+     * Get a value associated with a key
+     *
+     * The value should have been set previously.
+     *
+     * @param string &$key   in; Lookup key
+     * @param mixed  &$value out; value associated with key
+     *
+     * @return boolean hook success
+     */
+
+    function onStartCacheGet(&$key, &$value)
+    {
+        $this->_ensureConn();
+        $value = $this->_conn->get($key);
+        Event::handle('EndCacheGet', array($key, &$value));
+        return false;
+    }
+
+    /**
+     * Associate a value with a key
+     *
+     * @param string  &$key     in; Key to use for lookups
+     * @param mixed   &$value   in; Value to associate
+     * @param integer &$flag    in; Flag empty or Cache::COMPRESSED
+     * @param integer &$expiry  in; Expiry (passed through to Memcache)
+     * @param boolean &$success out; Whether the set was successful
+     *
+     * @return boolean hook success
+     */
+
+    function onStartCacheSet(&$key, &$value, &$flag, &$expiry, &$success)
+    {
+        $this->_ensureConn();
+        if ($expiry === null) {
+            $expiry = $this->defaultExpiry;
+        }
+        $success = $this->_conn->set($key, $value, $expiry);
+        Event::handle('EndCacheSet', array($key, $value, $flag,
+                                           $expiry));
+        return false;
+    }
+
+    /**
+     * Atomically increment an existing numeric key value.
+     * Existing expiration time will not be changed.
+     *
+     * @param string &$key    in; Key to use for lookups
+     * @param int    &$step   in; Amount to increment (default 1)
+     * @param mixed  &$value  out; Incremented value, or false if key not set.
+     *
+     * @return boolean hook success
+     */
+    function onStartCacheIncrement(&$key, &$step, &$value)
+    {
+        $this->_ensureConn();
+        $value = $this->_conn->increment($key, $step);
+        Event::handle('EndCacheIncrement', array($key, $step, $value));
+        return false;
+    }
+
+    /**
+     * Delete a value associated with a key
+     *
+     * @param string  &$key     in; Key to lookup
+     * @param boolean &$success out; whether it worked
+     *
+     * @return boolean hook success
+     */
+
+    function onStartCacheDelete(&$key, &$success)
+    {
+        $this->_ensureConn();
+        $success = $this->_conn->delete($key);
+        Event::handle('EndCacheDelete', array($key));
+        return false;
+    }
+
+    function onStartCacheReconnect(&$success)
+    {
+        // nothing to do
+        return true;
+    }
+
+    /**
+     * Ensure that a connection exists
+     *
+     * Checks the instance $_conn variable and connects
+     * if it is empty.
+     *
+     * @return void
+     */
+
+    private function _ensureConn()
+    {
+        if (empty($this->_conn)) {
+            $this->_conn = new Memcached(common_config('site', 'nickname'));
+
+            if (!count($this->_conn->getServerList())) {
+            if (is_array($this->servers)) {
+                $servers = $this->servers;
+            } else {
+                $servers = array($this->servers);
+            }
+            foreach ($servers as $server) {
+                if (strpos($server, ';') !== false) {
+                    list($host, $port) = explode(';', $server);
+                } else {
+                    $host = $server;
+                    $port = 11211;
+                }
+
+                $this->_conn->addServer($host, $port);
+            }
+
+            // Compress items stored in the cache.
+
+            // Allows the cache to store objects larger than 1MB (if they
+            // compress to less than 1MB), and improves cache memory efficiency.
+
+            $this->_conn->setOption(Memcached::OPT_COMPRESSION, true);
+            }
+        }
+    }
+
+    /**
+     * Translate general flags to Memcached-specific flags
+     * @param int $flag
+     * @return int
+     */
+    protected function flag($flag)
+    {
+        //no flags are presently supported
+        return $flag;
+    }
+
+    function onPluginVersion(&$versions)
+    {
+        $versions[] = array('name' => 'Memcached',
+                            'version' => STATUSNET_VERSION,
+                            'author' => 'Evan Prodromou, Craig Andrews',
+                            'homepage' => 'http://status.net/wiki/Plugin:Memcached',
+                            'rawdescription' =>
+                            _m('Use <a href="http://memcached.org/">Memcached</a> to cache query results.'));
+        return true;
+    }
+}
+
diff --git a/plugins/MobileProfile/MobileProfilePlugin.php b/plugins/MobileProfile/MobileProfilePlugin.php
index cd2531fa7..0b37734b7 100644
--- a/plugins/MobileProfile/MobileProfilePlugin.php
+++ b/plugins/MobileProfile/MobileProfilePlugin.php
@@ -307,25 +307,14 @@ class MobileProfilePlugin extends WAP20Plugin
     function _showPrimaryNav($action)
     {
         $user    = common_current_user();
-        $connect = '';
-        if (common_config('xmpp', 'enabled')) {
-            $connect = 'imsettings';
-        } else if (common_config('sms', 'enabled')) {
-            $connect = 'smssettings';
-        } else if (common_config('twitter', 'enabled')) {
-            $connect = 'twittersettings';
-        }
-
         $action->elementStart('ul', array('id' => 'site_nav_global_primary'));
         if ($user) {
             $action->menuItem(common_local_url('all', array('nickname' => $user->nickname)),
                             _('Home'));
             $action->menuItem(common_local_url('profilesettings'),
                             _('Account'));
-            if ($connect) {
-                $action->menuItem(common_local_url($connect),
+            $action->menuItem(common_local_url('oauthconnectionssettings'),
                                 _('Connect'));
-            }
             if ($user->hasRight(Right::CONFIGURESITE)) {
                 $action->menuItem(common_local_url('siteadminpanel'),
                                 _('Admin'), _('Change site configuration'), false, 'nav_admin');
diff --git a/plugins/OStatus/OStatusPlugin.php b/plugins/OStatus/OStatusPlugin.php
index e7ffd6cc2..efb630297 100644
--- a/plugins/OStatus/OStatusPlugin.php
+++ b/plugins/OStatus/OStatusPlugin.php
@@ -43,16 +43,20 @@ class OStatusPlugin extends Plugin
         // Discovery actions
         $m->connect('.well-known/host-meta',
                     array('action' => 'hostmeta'));
-        $m->connect('main/webfinger',
-                    array('action' => 'webfinger'));
+        $m->connect('main/xrd',
+                    array('action' => 'userxrd'));
+        $m->connect('main/ownerxrd',
+                    array('action' => 'ownerxrd'));
         $m->connect('main/ostatus',
                     array('action' => 'ostatusinit'));
         $m->connect('main/ostatus?nickname=:nickname',
                   array('action' => 'ostatusinit'), array('nickname' => '[A-Za-z0-9_-]+'));
+        $m->connect('main/ostatus?group=:group',
+                  array('action' => 'ostatusinit'), array('group' => '[A-Za-z0-9_-]+'));
         $m->connect('main/ostatussub',
                     array('action' => 'ostatussub'));
-        $m->connect('main/ostatussub',
-                    array('action' => 'ostatussub'), array('feed' => '[A-Za-z0-9\.\/\:]+'));
+        $m->connect('main/ostatusgroup',
+                    array('action' => 'ostatusgroup'));
 
         // PuSH actions
         $m->connect('main/push/hub', array('action' => 'pushhub'));
@@ -103,6 +107,20 @@ class OStatusPlugin extends Plugin
     }
 
     /**
+     * Add a link header for LRDD Discovery
+     */
+    function onStartShowHTML($action)
+    {
+        if ($action instanceof ShowstreamAction) {
+            $acct = 'acct:'. $action->profile->nickname .'@'. common_config('site', 'server');
+            $url = common_local_url('userxrd');
+            $url.= '?uri='. $acct;
+
+            header('Link: <'.$url.'>; rel="'. Discovery::LRDD_REL.'"; type="application/xrd+xml"');
+        }
+    }
+
+    /**
      * Set up a PuSH hub link to our internal link for canonical timeline
      * Atom feeds for users and groups.
      */
@@ -135,7 +153,8 @@ class OStatusPlugin extends Plugin
 
             // Also, we'll add in the salmon link
             $salmon = common_local_url($salmonAction, array('id' => $id));
-            $feed->addLink($salmon, array('rel' => 'salmon'));
+            $feed->addLink($salmon, array('rel' => Salmon::NS_REPLIES));
+            $feed->addLink($salmon, array('rel' => Salmon::NS_MENTIONS));
         }
 
         return true;
@@ -195,6 +214,22 @@ class OStatusPlugin extends Plugin
         return false;
     }
 
+    function onStartGroupSubscribe($output, $group)
+    {
+        $cur = common_current_user();
+
+        if (empty($cur)) {
+            // Add an OStatus subscribe
+            $url = common_local_url('ostatusinit',
+                                    array('group' => $group->nickname));
+            $output->element('a', array('href' => $url,
+                                        'class' => 'entity_remote_subscribe'),
+                                _m('Join'));
+        }
+
+        return true;
+    }
+
     /**
      * Check if we've got remote replies to send via Salmon.
      *
@@ -207,40 +242,81 @@ class OStatusPlugin extends Plugin
     }
 
     /**
-     *
+     * Find any explicit remote mentions. Accepted forms:
+     *   Webfinger: @user@example.com
+     *   Profile link: @example.com/mublog/user
+     * @param Profile $sender (os user?)
+     * @param string $text input markup text
+     * @param array &$mention in/out param: set of found mentions
+     * @return boolean hook return value
      */
 
-    function onStartFindMentions($sender, $text, &$mentions)
+    function onEndFindMentions($sender, $text, &$mentions)
     {
-        preg_match_all('/(?:^|\s+)@((?:\w+\.)*\w+@(?:\w+\.)*\w+(?:\w+\-\w+)*\.\w+)/',
+        $matches = array();
+
+        // Webfinger matches: @user@example.com
+        if (preg_match_all('!(?:^|\s+)@((?:\w+\.)*\w+@(?:\w+\.)*\w+(?:\w+\-\w+)*\.\w+)!',
                        $text,
                        $wmatches,
-                       PREG_OFFSET_CAPTURE);
-
-        foreach ($wmatches[1] as $wmatch) {
-
-            $webfinger = $wmatch[0];
-
-            $this->log(LOG_INFO, "Checking Webfinger for address '$webfinger'");
-
-            $oprofile = Ostatus_profile::ensureWebfinger($webfinger);
-
-            if (empty($oprofile)) {
-
-                $this->log(LOG_INFO, "No Ostatus_profile found for address '$webfinger'");
-
-            } else {
-
-                $this->log(LOG_INFO, "Ostatus_profile found for address '$webfinger'");
+                       PREG_OFFSET_CAPTURE)) {
+            foreach ($wmatches[1] as $wmatch) {
+                list($target, $pos) = $wmatch;
+                $this->log(LOG_INFO, "Checking webfinger '$target'");
+                try {
+                    $oprofile = Ostatus_profile::ensureWebfinger($target);
+                    if ($oprofile && !$oprofile->isGroup()) {
+                        $profile = $oprofile->localProfile();
+                        $matches[$pos] = array('mentioned' => array($profile),
+                                               'text' => $target,
+                                               'position' => $pos,
+                                               'url' => $profile->profileurl);
+                    }
+                } catch (Exception $e) {
+                    $this->log(LOG_ERR, "Webfinger check failed: " . $e->getMessage());
+                }
+            }
+        }
 
-                $profile = $oprofile->localProfile();
+        // Profile matches: @example.com/mublog/user
+        if (preg_match_all('!(?:^|\s+)@((?:\w+\.)*\w+(?:\w+\-\w+)*\.\w+(?:/\w+)+)!',
+                       $text,
+                       $wmatches,
+                       PREG_OFFSET_CAPTURE)) {
+            foreach ($wmatches[1] as $wmatch) {
+                list($target, $pos) = $wmatch;
+                $schemes = array('http', 'https');
+                foreach ($schemes as $scheme) {
+                    $url = "$scheme://$target";
+                    $this->log(LOG_INFO, "Checking profile address '$url'");
+                    try {
+                        $oprofile = Ostatus_profile::ensureProfile($url);
+                        if ($oprofile && !$oprofile->isGroup()) {
+                            $profile = $oprofile->localProfile();
+                            $matches[$pos] = array('mentioned' => array($profile),
+                                                   'text' => $target,
+                                                   'position' => $pos,
+                                                   'url' => $profile->profileurl);
+                            break;
+                        }
+                    } catch (Exception $e) {
+                        $this->log(LOG_ERR, "Profile check failed: " . $e->getMessage());
+                    }
+                }
+            }
+        }
 
-                $mentions[] = array('mentioned' => array($profile),
-                                    'text' => $wmatch[0],
-                                    'position' => $wmatch[1],
-                                    'url' => $profile->profileurl);
+        foreach ($mentions as $i => $other) {
+            // If we share a common prefix with a local user, override it!
+            $pos = $other['position'];
+            if (isset($matches[$pos])) {
+                $mentions[$i] = $matches[$pos];
+                unset($matches[$pos]);
             }
         }
+        foreach ($matches as $mention) {
+            $mentions[] = $mention;
+        }
 
         return true;
     }
@@ -390,7 +466,7 @@ class OStatusPlugin extends Plugin
         $act->actor   = ActivityObject::fromProfile($subscriber);
         $act->object  = ActivityObject::fromProfile($other);
 
-        $oprofile->notifyActivity($act);
+        $oprofile->notifyActivity($act, $subscriber);
 
         return true;
     }
@@ -438,7 +514,7 @@ class OStatusPlugin extends Plugin
         $act->actor   = ActivityObject::fromProfile($profile);
         $act->object  = ActivityObject::fromProfile($other);
 
-        $oprofile->notifyActivity($act);
+        $oprofile->notifyActivity($act, $profile);
 
         return true;
     }
@@ -480,7 +556,7 @@ class OStatusPlugin extends Plugin
                                     $member->getBestName(),
                                     $oprofile->getBestName());
 
-            if ($oprofile->notifyActivity($act)) {
+            if ($oprofile->notifyActivity($act, $member)) {
                 return true;
             } else {
                 $oprofile->garbageCollect();
@@ -511,7 +587,6 @@ class OStatusPlugin extends Plugin
             // Drop the PuSH subscription if there are no other subscribers.
             $oprofile->garbageCollect();
 
-
             $member = Profile::staticGet($user->id);
 
             $act = new Activity();
@@ -530,7 +605,7 @@ class OStatusPlugin extends Plugin
                                     $member->getBestName(),
                                     $oprofile->getBestName());
 
-            $oprofile->notifyActivity($act);
+            $oprofile->notifyActivity($act, $member);
         }
     }
 
@@ -573,7 +648,7 @@ class OStatusPlugin extends Plugin
         $act->actor   = ActivityObject::fromProfile($profile);
         $act->object  = ActivityObject::fromNotice($notice);
 
-        $oprofile->notifyActivity($act);
+        $oprofile->notifyActivity($act, $profile);
 
         return true;
     }
@@ -617,7 +692,7 @@ class OStatusPlugin extends Plugin
         $act->actor   = ActivityObject::fromProfile($profile);
         $act->object  = ActivityObject::fromNotice($notice);
 
-        $oprofile->notifyActivity($act);
+        $oprofile->notifyActivity($act, $profile);
 
         return true;
     }
@@ -634,7 +709,7 @@ class OStatusPlugin extends Plugin
 
     function onStartUserGroupHomeUrl($group, &$url)
     {
-        return $this->onStartUserGroupPermalink($group, &$url);
+        return $this->onStartUserGroupPermalink($group, $url);
     }
 
     function onStartUserGroupPermalink($group, &$url)
@@ -650,19 +725,45 @@ class OStatusPlugin extends Plugin
 
     function onStartShowSubscriptionsContent($action)
     {
+        $this->showEntityRemoteSubscribe($action);
+
+        return true;
+    }
+
+    function onStartShowUserGroupsContent($action)
+    {
+        $this->showEntityRemoteSubscribe($action, 'ostatusgroup');
+
+        return true;
+    }
+
+    function onEndShowSubscriptionsMiniList($action)
+    {
+        $this->showEntityRemoteSubscribe($action);
+
+        return true;
+    }
+
+    function onEndShowGroupsMiniList($action)
+    {
+        $this->showEntityRemoteSubscribe($action, 'ostatusgroup');
+
+        return true;
+    }
+
+    function showEntityRemoteSubscribe($action, $target='ostatussub')
+    {
         $user = common_current_user();
         if ($user && ($user->id == $action->profile->id)) {
             $action->elementStart('div', 'entity_actions');
             $action->elementStart('p', array('id' => 'entity_remote_subscribe',
                                              'class' => 'entity_subscribe'));
-            $action->element('a', array('href' => common_local_url('ostatussub'),
+            $action->element('a', array('href' => common_local_url($target),
                                         'class' => 'entity_remote_subscribe')
-                                , _m('Subscribe to remote user'));
+                                , _m('Remote'));
             $action->elementEnd('p');
             $action->elementEnd('div');
         }
-
-        return true;
     }
 
     /**
@@ -706,9 +807,46 @@ class OStatusPlugin extends Plugin
         $act->object  = $act->actor;
 
         while ($oprofile->fetch()) {
-            $oprofile->notifyDeferred($act);
+            $oprofile->notifyDeferred($act, $profile);
+        }
+
+        return true;
+    }
+
+    function onStartProfileListItemActionElements($item)
+    {
+        if (!common_logged_in()) {
+
+            $profileUser = User::staticGet('id', $item->profile->id);
+
+            if (!empty($profileUser)) {
+
+                $output = $item->out;
+
+                // Add an OStatus subscribe
+                $output->elementStart('li', 'entity_subscribe');
+                $url = common_local_url('ostatusinit',
+                                        array('nickname' => $profileUser->nickname));
+                $output->element('a', array('href' => $url,
+                                            'class' => 'entity_remote_subscribe'),
+                                 _m('Subscribe'));
+                $output->elementEnd('li');
+            }
         }
 
         return true;
     }
+
+    function onPluginVersion(&$versions)
+    {
+        $versions[] = array('name' => 'OStatus',
+                            'version' => STATUSNET_VERSION,
+                            'author' => 'Evan Prodromou, James Walker, Brion Vibber, Zach Copley',
+                            'homepage' => 'http://status.net/wiki/Plugin:OStatus',
+                            'rawdescription' =>
+                            _m('Follow people across social networks that implement '.
+                               '<a href="http://ostatus.org/">OStatus</a>.'));
+
+        return true;
+    }
 }
diff --git a/plugins/OStatus/actions/hostmeta.php b/plugins/OStatus/actions/hostmeta.php
index 850b8a0fe..6d35ada6c 100644
--- a/plugins/OStatus/actions/hostmeta.php
+++ b/plugins/OStatus/actions/hostmeta.php
@@ -31,12 +31,18 @@ class HostMetaAction extends Action
     {
         parent::handle();
 
-        $w = new Webfinger();
-
-
         $domain = common_config('site', 'server');
-        $url = common_local_url('webfinger');
+        $url = common_local_url('userxrd');
         $url.= '?uri={uri}';
-        print $w->getHostMeta($domain, $url);
+
+        $xrd = new XRD();
+        
+        $xrd = new XRD();
+        $xrd->host = $domain;
+        $xrd->links[] = array('rel' => Discovery::LRDD_REL,
+                              'template' => $url,
+                              'title' => array('Resource Descriptor'));
+
+        print $xrd->toXML();
     }
 }
diff --git a/plugins/OStatus/actions/ostatusgroup.php b/plugins/OStatus/actions/ostatusgroup.php
new file mode 100644
index 000000000..f325ba053
--- /dev/null
+++ b/plugins/OStatus/actions/ostatusgroup.php
@@ -0,0 +1,181 @@
+<?php
+/*
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2009-2010, StatusNet, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * @package OStatusPlugin
+ * @maintainer Brion Vibber <brion@status.net>
+ */
+
+if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
+
+/**
+ * Key UI methods:
+ *
+ *  showInputForm() - form asking for a remote profile account or URL
+ *                    We end up back here on errors
+ *
+ *  showPreviewForm() - surrounding form for preview-and-confirm
+ *    preview() - display profile for a remote group
+ *
+ *  success() - redirects to groups page on join
+ */
+class OStatusGroupAction extends OStatusSubAction
+{
+    protected $profile_uri; // provided acct: or URI of remote entity
+    protected $oprofile; // Ostatus_profile of remote entity, if valid
+
+
+    function validateRemoteProfile()
+    {
+        if (!$this->oprofile->isGroup()) {
+            // Send us to the user subscription form for conf
+            $target = common_local_url('ostatussub', array(), array('profile' => $this->profile_uri));
+            common_redirect($target, 303);
+        }
+    }
+
+    /**
+     * Show the initial form, when we haven't yet been given a valid
+     * remote profile.
+     */
+    function showInputForm()
+    {
+        $user = common_current_user();
+
+        $profile = $user->getProfile();
+
+        $this->elementStart('form', array('method' => 'post',
+                                          'id' => 'form_ostatus_sub',
+                                          'class' => 'form_settings',
+                                          'action' => $this->selfLink()));
+
+        $this->hidden('token', common_session_token());
+
+        $this->elementStart('fieldset', array('id' => 'settings_feeds'));
+
+        $this->elementStart('ul', 'form_data');
+        $this->elementStart('li');
+        $this->input('profile',
+                     _m('Join group'),
+                     $this->profile_uri,
+                     _m("OStatus group's address, like http://example.net/group/nickname"));
+        $this->elementEnd('li');
+        $this->elementEnd('ul');
+
+        $this->submit('validate', _m('Continue'));
+
+        $this->elementEnd('fieldset');
+
+        $this->elementEnd('form');
+    }
+
+    /**
+     * Show a preview for a remote group's profile
+     * @return boolean true if we're ok to try joining
+     */
+    function preview()
+    {
+        $oprofile = $this->oprofile;
+        $group = $oprofile->localGroup();
+
+        $cur = common_current_user();
+        if ($cur->isMember($group)) {
+            $this->element('div', array('class' => 'error'),
+                           _m("You are already a member of this group."));
+            $ok = false;
+        } else {
+            $ok = true;
+        }
+
+        $this->showEntity($group,
+                          $group->getProfileUrl(),
+                          $group->homepage_logo,
+                          $group->description);
+        return $ok;
+    }
+
+    /**
+     * Redirect on successful remote group join
+     */
+    function success()
+    {
+        $cur = common_current_user();
+        $url = common_local_url('usergroups', array('nickname' => $cur->nickname));
+        common_redirect($url, 303);
+    }
+
+    /**
+     * Attempt to finalize subscription.
+     * validateFeed must have been run first.
+     *
+     * Calls showForm on failure or success on success.
+     */
+    function saveFeed()
+    {
+        $user = common_current_user();
+        $group = $this->oprofile->localGroup();
+        if ($user->isMember($group)) {
+            // TRANS: OStatus remote group subscription dialog error.
+            $this->showForm(_m('Already a member!'));
+            return;
+        }
+
+        if (Event::handle('StartJoinGroup', array($group, $user))) {
+            $ok = Group_member::join($this->oprofile->group_id, $user->id);
+            if ($ok) {
+                Event::handle('EndJoinGroup', array($group, $user));
+                $this->success();
+            } else {
+                // TRANS: OStatus remote group subscription dialog error.
+                $this->showForm(_m('Remote group join failed!'));
+            }
+        } else {
+            // TRANS: OStatus remote group subscription dialog error.
+            $this->showForm(_m('Remote group join aborted!'));
+        }
+    }
+
+    /**
+     * Title of the page
+     *
+     * @return string Title of the page
+     */
+
+    function title()
+    {
+        // TRANS: Page title for OStatus remote group join form
+        return _m('Confirm joining remote group');
+    }
+
+    /**
+     * Instructions for use
+     *
+     * @return instructions for use
+     */
+
+    function getInstructions()
+    {
+        return _m('You can subscribe to groups from other supported sites. Paste the group\'s profile URI below:');
+    }
+
+    function selfLink()
+    {
+        return common_local_url('ostatusgroup');
+    }
+}
diff --git a/plugins/OStatus/actions/ostatusinit.php b/plugins/OStatus/actions/ostatusinit.php
index 3f2f6368f..22aea9f70 100644
--- a/plugins/OStatus/actions/ostatusinit.php
+++ b/plugins/OStatus/actions/ostatusinit.php
@@ -29,6 +29,7 @@ class OStatusInitAction extends Action
 {
 
     var $nickname;
+    var $group;
     var $profile;
     var $err;
 
@@ -41,8 +42,9 @@ class OStatusInitAction extends Action
             return false;
         }
 
-        // Local user the remote wants to subscribe to
+        // Local user or group the remote wants to subscribe to
         $this->nickname = $this->trimmed('nickname');
+        $this->group = $this->trimmed('group');
         
         // Webfinger or profile URL of the remote user
         $this->profile = $this->trimmed('profile');
@@ -89,25 +91,33 @@ class OStatusInitAction extends Action
 
     function showContent()
     {
+        if ($this->group) {
+            $header = sprintf(_m('Join group %s'), $this->group);
+            $submit = _m('Join');
+        } else {
+            $header = sprintf(_m('Subscribe to %s'), $this->nickname);
+            $submit = _m('Subscribe');
+        }
         $this->elementStart('form', array('id' => 'form_ostatus_connect',
                                           'method' => 'post',
                                           'class' => 'form_settings',
                                           'action' => common_local_url('ostatusinit')));
         $this->elementStart('fieldset');
-        $this->element('legend', null,  sprintf(_m('Subscribe to %s'), $this->nickname));
+        $this->element('legend', null,  $header);
         $this->hidden('token', common_session_token());
 
         $this->elementStart('ul', 'form_data');
         $this->elementStart('li', array('id' => 'ostatus_nickname'));
         $this->input('nickname', _m('User nickname'), $this->nickname,
                      _m('Nickname of the user you want to follow'));
+        $this->hidden('group', $this->group); // pass-through for magic links
         $this->elementEnd('li');
         $this->elementStart('li', array('id' => 'ostatus_profile'));
         $this->input('profile', _m('Profile Account'), $this->profile,
                      _m('Your account id (i.e. user@identi.ca)'));
         $this->elementEnd('li');
         $this->elementEnd('ul');
-        $this->submit('submit', _m('Subscribe'));
+        $this->submit('submit', $submit);
         $this->elementEnd('fieldset');
         $this->elementEnd('form');
     }
@@ -131,20 +141,18 @@ class OStatusInitAction extends Action
 
     function connectWebfinger($acct)
     {
-        $w = new Webfinger;
+        $target_profile = $this->targetProfile();
 
-        $result = $w->lookup($acct);
+        $disco = new Discovery;
+        $result = $disco->lookup($acct);
         if (!$result) {
             $this->clientError(_m("Couldn't look up OStatus account profile."));
         }
+
         foreach ($result->links as $link) {
             if ($link['rel'] == 'http://ostatus.org/schema/1.0/subscribe') {
                 // We found a URL - let's redirect!
-
-                $user = User::staticGet('nickname', $this->nickname);
-                $target_profile = common_local_url('userbyid', array('id' => $user->id));
-
-                $url = $w->applyTemplate($link['template'], $target_profile);
+                $url = Discovery::applyTemplate($link['template'], $target_profile);
                 common_log(LOG_INFO, "Sending remote subscriber $acct to $url");
                 common_redirect($url, 303);
             }
@@ -155,8 +163,7 @@ class OStatusInitAction extends Action
 
     function connectProfile($subscriber_profile)
     {
-        $user = User::staticGet('nickname', $this->nickname);
-        $target_profile = common_local_url('userbyid', array('id' => $user->id));
+        $target_profile = $this->targetProfile();
 
         // @fixme hack hack! We should look up the remote sub URL from XRDS
         $suburl = preg_replace('!^(.*)/(.*?)$!', '$1/main/ostatussub', $subscriber_profile);
@@ -166,6 +173,30 @@ class OStatusInitAction extends Action
         common_redirect($suburl, 303);
     }
 
+    /**
+     * Build the canonical profile URI+URL of the requested user or group
+     */
+    function targetProfile()
+    {
+        if ($this->nickname) {
+            $user = User::staticGet('nickname', $this->nickname);
+            if ($user) {
+                return common_local_url('userbyid', array('id' => $user->id));
+            } else {
+                $this->clientError("No such user.");
+            }
+        } else if ($this->group) {
+            $group = Local_group::staticGet('nickname', $this->group);
+            if ($group) {
+                return common_local_url('groupbyid', array('id' => $group->group_id));
+            } else {
+                $this->clientError("No such group.");
+            }
+        } else {
+            $this->clientError("No local user or group nickname provided.");
+        }
+    }
+
     function title()
     {
       return _m('OStatus Connect');  
diff --git a/plugins/OStatus/actions/ostatussub.php b/plugins/OStatus/actions/ostatussub.php
index 12832cdcf..65dee2392 100644
--- a/plugins/OStatus/actions/ostatussub.php
+++ b/plugins/OStatus/actions/ostatussub.php
@@ -1,7 +1,7 @@
 <?php
 /*
  * StatusNet - the distributed open-source microblogging tool
- * Copyright (C) 2009, StatusNet, Inc.
+ * Copyright (C) 2009-2010, StatusNet, Inc.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as published by
@@ -31,11 +31,9 @@ if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
  *                    We end up back here on errors
  *
  *  showPreviewForm() - surrounding form for preview-and-confirm
- *    previewUser() - display profile for a remote user
- *    previewGroup() - display profile for a remote group
+ *    preview() - display profile for a remote user
  *
- *  successUser() - redirects to subscriptions page on subscribe
- *  successGroup() - redirects to groups page on join
+ *  success() - redirects to subscriptions page on subscribe
  */
 class OStatusSubAction extends Action
 {
@@ -55,8 +53,7 @@ class OStatusSubAction extends Action
         $this->elementStart('form', array('method' => 'post',
                                           'id' => 'form_ostatus_sub',
                                           'class' => 'form_settings',
-                                          'action' =>
-                                          common_local_url('ostatussub')));
+                                          'action' => $this->selfLink()));
 
         $this->hidden('token', common_session_token());
 
@@ -65,9 +62,9 @@ class OStatusSubAction extends Action
         $this->elementStart('ul', 'form_data');
         $this->elementStart('li');
         $this->input('profile',
-                     _m('Address or profile URL'),
+                     _m('Subscribe to'),
                      $this->profile_uri,
-                     _m('Enter the profile URL of a PubSubHubbub-enabled feed'));
+                     _m("OStatus user's address, like nickname@example.com or http://example.net/nickname"));
         $this->elementEnd('li');
         $this->elementEnd('ul');
 
@@ -87,11 +84,7 @@ class OStatusSubAction extends Action
      */
     function showPreviewForm()
     {
-        if ($this->oprofile->isGroup()) {
-            $ok = $this->previewGroup();
-        } else {
-            $ok = $this->previewUser();
-        }
+        $ok = $this->preview();
         if (!$ok) {
             // @fixme maybe provide a cancel button or link back?
             return;
@@ -104,7 +97,7 @@ class OStatusSubAction extends Action
                                           'id' => 'form_ostatus_sub',
                                           'class' => 'form_remote_authorize',
                                           'action' =>
-                                          common_local_url('ostatussub')));
+                                          $this->selfLink()));
         $this->elementStart('fieldset');
         $this->hidden('token', common_session_token());
         $this->hidden('profile', $this->profile_uri);
@@ -112,7 +105,7 @@ class OStatusSubAction extends Action
             $this->submit('submit', _m('Join'), 'submit', null,
                          _m('Join this group'));
         } else {
-            $this->submit('submit', _m('Subscribe'), 'submit', null,
+            $this->submit('submit', _m('Confirm'), 'submit', null,
                          _m('Subscribe to this user'));
         }
         $this->elementEnd('fieldset');
@@ -126,7 +119,7 @@ class OStatusSubAction extends Action
      * Show a preview for a remote user's profile
      * @return boolean true if we're ok to try subscribing
      */
-    function previewUser()
+    function preview()
     {
         $oprofile = $this->oprofile;
         $profile = $oprofile->localProfile();
@@ -150,32 +143,6 @@ class OStatusSubAction extends Action
         return $ok;
     }
 
-    /**
-     * Show a preview for a remote group's profile
-     * @return boolean true if we're ok to try joining
-     */
-    function previewGroup()
-    {
-        $oprofile = $this->oprofile;
-        $group = $oprofile->localGroup();
-
-        $cur = common_current_user();
-        if ($cur->isMember($group)) {
-            $this->element('div', array('class' => 'error'),
-                           _m("You are already a member of this group."));
-            $ok = false;
-        } else {
-            $ok = true;
-        }
-
-        $this->showEntity($group,
-                          $group->getProfileUrl(),
-                          $group->homepage_logo,
-                          $group->description);
-        return $ok;
-    }
-
-
     function showEntity($entity, $profile, $avatar, $note)
     {
         $nickname = $entity->nickname;
@@ -254,7 +221,7 @@ class OStatusSubAction extends Action
     /**
      * Redirect on successful remote user subscription
      */
-    function successUser()
+    function success()
     {
         $cur = common_current_user();
         $url = common_local_url('subscriptions', array('nickname' => $cur->nickname));
@@ -262,91 +229,81 @@ class OStatusSubAction extends Action
     }
 
     /**
-     * Redirect on successful remote group join
-     */
-    function successGroup()
-    {
-        $cur = common_current_user();
-        $url = common_local_url('usergroups', array('nickname' => $cur->nickname));
-        common_redirect($url, 303);
-    }
-
-    /**
      * Pull data for a remote profile and check if it's valid.
      * Fills out error UI string in $this->error
      * Fills out $this->oprofile on success.
      *
      * @return boolean
      */
-    function validateFeed()
+    function pullRemoteProfile()
     {
-        $profile_uri = trim($this->arg('profile'));
-
-        if ($profile_uri == '') {
-            $this->showForm(_m('Empty remote profile URL!'));
-            return;
-        }
-        $this->profile_uri = $profile_uri;
-
+        $this->profile_uri = $this->trimmed('profile');
         try {
             if (Validate::email($this->profile_uri)) {
                 $this->oprofile = Ostatus_profile::ensureWebfinger($this->profile_uri);
             } else if (Validate::uri($this->profile_uri)) {
                 $this->oprofile = Ostatus_profile::ensureProfile($this->profile_uri);
             } else {
-                $this->error = _m("Invalid address format.");
+                $this->error = _m("Sorry, we could not reach that address. Please make sure that the OStatus address is like nickname@example.com or http://example.net/nickname");
+                common_debug('Invalid address format.', __FILE__);
                 return false;
             }
             return true;
         } catch (FeedSubBadURLException $e) {
-            $this->error = _m('Invalid URL or could not reach server.');
+            $this->error = _m("Sorry, we could not reach that address. Please make sure that the OStatus address is like nickname@example.com or http://example.net/nickname");
+            common_debug('Invalid URL or could not reach server.', __FILE__);
         } catch (FeedSubBadResponseException $e) {
-            $this->error = _m('Cannot read feed; server returned error.');
+            $this->error = _m("Sorry, we could not reach that feed. Please try that OStatus address again later.");
+            common_debug('Cannot read feed; server returned error.', __FILE__);
         } catch (FeedSubEmptyException $e) {
-            $this->error = _m('Cannot read feed; server returned an empty page.');
+            $this->error = _m("Sorry, we could not reach that feed. Please try that OStatus address again later.");
+            common_debug('Cannot read feed; server returned an empty page.', __FILE__);
         } catch (FeedSubBadHTMLException $e) {
-            $this->error = _m('Bad HTML, could not find feed link.');
+            $this->error = _m("Sorry, we could not reach that feed. Please try that OStatus address again later.");
+            common_debug('Bad HTML, could not find feed link.', __FILE__);
         } catch (FeedSubNoFeedException $e) {
-            $this->error = _m('Could not find a feed linked from this URL.');
+            $this->error = _m("Sorry, we could not reach that feed. Please try that OStatus address again later.");
+            common_debug('Could not find a feed linked from this URL.', __FILE__);
         } catch (FeedSubUnrecognizedTypeException $e) {
-            $this->error = _m('Not a recognized feed type.');
-        } catch (FeedSubException $e) {
+            $this->error = _m("Sorry, we could not reach that feed. Please try that OStatus address again later.");
+            common_debug('Not a recognized feed type.', __FILE__);
+        } catch (Exception $e) {
             // Any new ones we forgot about
-            $this->error = sprintf(_m('Bad feed URL: %s %s'), get_class($e), $e->getMessage());
+            $this->error = _m("Sorry, we could not reach that address. Please make sure that the OStatus address is like nickname@example.com or http://example.net/nickname");
+            common_debug(sprintf('Bad feed URL: %s %s', get_class($e), $e->getMessage()), __FILE__);
         }
 
         return false;
     }
 
+    function validateRemoteProfile()
+    {
+        if ($this->oprofile->isGroup()) {
+            // Send us to the group subscription form for conf
+            $target = common_local_url('ostatusgroup', array(), array('profile' => $this->profile_uri));
+            common_redirect($target, 303);
+        }
+    }
+
     /**
      * Attempt to finalize subscription.
      * validateFeed must have been run first.
      *
-     * Calls showForm on failure or successUser/successGroup on success.
+     * Calls showForm on failure or success on success.
      */
     function saveFeed()
     {
         // And subscribe the current user to the local profile
         $user = common_current_user();
-
-        if ($this->oprofile->isGroup()) {
-            $group = $this->oprofile->localGroup();
-            if ($user->isMember($group)) {
-                $this->showForm(_m('Already a member!'));
-            } elseif (Group_member::join($this->oprofile->group_id, $user->id)) {
-                $this->successGroup();
-            } else {
-                $this->showForm(_m('Remote group join failed!'));
-            }
+        $local = $this->oprofile->localProfile();
+        if ($user->isSubscribed($local)) {
+            // TRANS: OStatus remote subscription dialog error.
+            $this->showForm(_m('Already subscribed!'));
+        } elseif ($this->oprofile->subscribeLocalToRemote($user)) {
+            $this->success();
         } else {
-            $local = $this->oprofile->localProfile();
-            if ($user->isSubscribed($local)) {
-                $this->showForm(_m('Already subscribed!'));
-            } elseif ($this->oprofile->subscribeLocalToRemote($user)) {
-                $this->successUser();
-            } else {
-                $this->showForm(_m('Remote subscription failed!'));
-            }
+            // TRANS: OStatus remote subscription dialog error.
+            $this->showForm(_m('Remote subscription failed!'));
         }
     }
 
@@ -363,8 +320,9 @@ class OStatusSubAction extends Action
             return false;
         }
 
-        $this->profile_uri = $this->arg('profile');
-
+        if ($this->pullRemoteProfile()) {
+            $this->validateRemoteProfile();
+        }
         return true;
     }
 
@@ -377,9 +335,6 @@ class OStatusSubAction extends Action
         if ($_SERVER['REQUEST_METHOD'] == 'POST') {
             $this->handlePost();
         } else {
-            if ($this->arg('profile')) {
-                $this->validateFeed();
-            }
             $this->showForm();
         }
     }
@@ -401,7 +356,7 @@ class OStatusSubAction extends Action
             return;
         }
 
-        if ($this->validateFeed()) {
+        if ($this->oprofile) {
             if ($this->arg('submit')) {
                 $this->saveFeed();
                 return;
@@ -442,7 +397,8 @@ class OStatusSubAction extends Action
 
     function title()
     {
-        return _m('Authorize subscription');
+        // TRANS: Page title for OStatus remote subscription form
+        return _m('Confirm');
     }
 
     /**
@@ -486,4 +442,9 @@ class OStatusSubAction extends Action
         parent::showScripts();
         $this->autofocus('feedurl');
     }
+
+    function selfLink()
+    {
+        return common_local_url('ostatussub');
+    }
 }
diff --git a/plugins/OStatus/actions/ownerxrd.php b/plugins/OStatus/actions/ownerxrd.php
new file mode 100644
index 000000000..9c141d8c7
--- /dev/null
+++ b/plugins/OStatus/actions/ownerxrd.php
@@ -0,0 +1,56 @@
+<?php
+/*
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2010, StatusNet, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * @package OStatusPlugin
+ * @maintainer James Walker <james@status.net>
+ */
+
+if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
+
+class OwnerxrdAction extends XrdAction
+{
+
+    public $uri;
+
+    function prepare($args)
+    {
+        $this->user = User::siteOwner();
+        
+        if (!$this->user) {
+            $this->clientError(_('No such user.'), 404);
+            return false;
+        }
+
+        $nick = common_canonical_nickname($this->user->nickname);
+        $acct = 'acct:' . $nick . '@' . common_config('site', 'server');
+        
+        $this->xrd = new XRD();
+
+        // Check to see if a $config['webfinger']['owner'] has been set
+        if ($owner = common_config('webfinger', 'owner')) {
+            $this->xrd->subject = Discovery::normalize($owner);
+            $this->xrd->alias[] = $acct;
+        } else {
+            $this->xrd->subject = $acct;
+        }
+
+        return true;
+    }
+}
diff --git a/plugins/OStatus/actions/pushhub.php b/plugins/OStatus/actions/pushhub.php
index f33690bc4..842d65e7d 100644
--- a/plugins/OStatus/actions/pushhub.php
+++ b/plugins/OStatus/actions/pushhub.php
@@ -104,7 +104,7 @@ class PushHubAction extends Action
             throw new ClientException("Invalid hub.secret $secret; must be under 200 bytes.");
         }
 
-        $sub = HubSub::staticGet($sub->topic, $sub->callback);
+        $sub = HubSub::staticGet($topic, $callback);
         if (!$sub) {
             // Creating a new one!
             $sub = new HubSub();
diff --git a/plugins/OStatus/actions/userxrd.php b/plugins/OStatus/actions/userxrd.php
new file mode 100644
index 000000000..414de9364
--- /dev/null
+++ b/plugins/OStatus/actions/userxrd.php
@@ -0,0 +1,48 @@
+<?php
+/*
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2010, StatusNet, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * @package OStatusPlugin
+ * @maintainer James Walker <james@status.net>
+ */
+
+if (!defined('STATUSNET')) { exit(1); }
+
+class UserxrdAction extends XrdAction
+{
+
+    function prepare($args)
+    {
+        parent::prepare($args);
+
+        $this->uri = $this->trimmed('uri');
+        $acct = Discovery::normalize($this->uri);
+
+        list($nick, $domain) = explode('@', substr(urldecode($acct), 5));
+        $nick = common_canonical_nickname($nick);
+
+        $this->user = User::staticGet('nickname', $nick);
+        if (!$this->user) {
+            $this->clientError(_('No such user.'), 404);
+            return false;
+        }
+
+        return true;
+    }
+}
diff --git a/plugins/OStatus/classes/HubSub.php b/plugins/OStatus/classes/HubSub.php
index 1ac181fee..3120a70f9 100644
--- a/plugins/OStatus/classes/HubSub.php
+++ b/plugins/OStatus/classes/HubSub.php
@@ -99,7 +99,7 @@ class HubSub extends Memcached_DataObject
         return array_keys($this->keyTypes());
     }
 
-    function sequenceKeys()
+    function sequenceKey()
     {
         return array(false, false, false);
     }
@@ -260,9 +260,15 @@ class HubSub extends Memcached_DataObject
             $retries = intval(common_config('ostatus', 'hub_retries'));
         }
 
-        $data = array('sub' => clone($this),
+        // We dare not clone() as when the clone is discarded it'll
+        // destroy the result data for the parent query.
+        // @fixme use clone() again when it's safe to copy an
+        // individual item from a multi-item query again.
+        $sub = HubSub::staticGet($this->topic, $this->callback);
+        $data = array('sub' => $sub,
                       'atom' => $atom,
                       'retries' => $retries);
+        common_log(LOG_INFO, "Queuing PuSH: $this->topic to $this->callback");
         $qm = QueueManager::get();
         $qm->enqueue($data, 'hubout');
     }
diff --git a/plugins/OStatus/classes/Magicsig.php b/plugins/OStatus/classes/Magicsig.php
index 681aec184..5a46aeeb6 100644
--- a/plugins/OStatus/classes/Magicsig.php
+++ b/plugins/OStatus/classes/Magicsig.php
@@ -49,7 +49,12 @@ class Magicsig extends Memcached_DataObject
     
     public /*static*/ function staticGet($k, $v=null)
     {
-        return parent::staticGet(__CLASS__, $k, $v);
+        $obj =  parent::staticGet(__CLASS__, $k, $v);
+        if (!empty($obj)) {
+            return Magicsig::fromString($obj->keypair);
+        }
+
+        return $obj;
     }
 
 
@@ -83,6 +88,10 @@ class Magicsig extends Memcached_DataObject
         return array('user_id' => 'K');
     }
 
+    function sequenceKey() {
+        return array(false, false, false);
+    }
+
     function insert()
     {
         $this->keypair = $this->toString();
@@ -90,7 +99,7 @@ class Magicsig extends Memcached_DataObject
         return parent::insert();
     }
 
-    public function generate($key_length = 512)
+    public function generate($user_id, $key_length = 512)
     {
         PEAR::pushErrorHandling(PEAR_ERROR_RETURN);
 
@@ -101,6 +110,7 @@ class Magicsig extends Memcached_DataObject
         $this->_rsa = new Crypt_RSA($params);
         PEAR::popErrorHandling();
 
+        $this->user_id = $user_id;
         $this->insert();
     }
 
@@ -136,8 +146,10 @@ class Magicsig extends Memcached_DataObject
         
         $mod = base64_url_decode($matches[1]);
         $exp = base64_url_decode($matches[2]);
-        if ($matches[4]) {
+        if (!empty($matches[4])) {
             $private_exp = base64_url_decode($matches[4]);
+        } else {
+            $private_exp = false;
         }
 
         $params['public_key'] = new Crypt_RSA_KEY($mod, $exp, 'public');
@@ -171,14 +183,15 @@ class Magicsig extends Memcached_DataObject
         switch ($this->alg) {
 
         case 'RSA-SHA256':
-            return 'sha256';
+            return 'magicsig_sha256';
         }
 
     }
     
     public function sign($bytes)
     {
-        $sig = $this->_rsa->createSign($bytes, null, 'sha256');
+        $hash = $this->getHash();
+        $sig = $this->_rsa->createSign($bytes, null, $hash);
         if ($this->_rsa->isError()) {
             $error = $this->_rsa->getLastError();
             common_log(LOG_DEBUG, 'RSA Error: '. $error->getMessage());
@@ -190,7 +203,8 @@ class Magicsig extends Memcached_DataObject
 
     public function verify($signed_bytes, $signature)
     {
-        $result =  $this->_rsa->validateSign($signed_bytes, $signature, null, 'sha256');
+        $hash = $this->getHash();
+        $result =  $this->_rsa->validateSign($signed_bytes, $signature, null, $hash);
         if ($this->_rsa->isError()) {
             $error = $this->keypair->getLastError();
             common_log(LOG_DEBUG, 'RSA Error: '. $error->getMessage());
@@ -203,7 +217,7 @@ class Magicsig extends Memcached_DataObject
 
 // Define a sha256 function for hashing
 // (Crypt_RSA should really be updated to use hash() )
-function sha256($bytes)
+function magicsig_sha256($bytes)
 {
     return hash('sha256', $bytes);
 }
diff --git a/plugins/OStatus/classes/Ostatus_profile.php b/plugins/OStatus/classes/Ostatus_profile.php
index a366c1c2c..abc8100ce 100644
--- a/plugins/OStatus/classes/Ostatus_profile.php
+++ b/plugins/OStatus/classes/Ostatus_profile.php
@@ -150,27 +150,7 @@ class Ostatus_profile extends Memcached_DataObject
     function asActivityObject()
     {
         if ($this->isGroup()) {
-            $object = new ActivityObject();
-            $object->type = 'http://activitystrea.ms/schema/1.0/group';
-            $object->id = $this->uri;
-            $self = $this->localGroup();
-
-            // @fixme put a standard getAvatar() interface on groups too
-            if ($self->homepage_logo) {
-                $object->avatar = $self->homepage_logo;
-                $map = array('png' => 'image/png',
-                             'jpg' => 'image/jpeg',
-                             'jpeg' => 'image/jpeg',
-                             'gif' => 'image/gif');
-                $extension = pathinfo(parse_url($avatarHref, PHP_URL_PATH), PATHINFO_EXTENSION);
-                if (isset($map[$extension])) {
-                    // @fixme this ain't used/saved yet
-                    $object->avatarType = $map[$extension];
-                }
-            }
-
-            $object->link = $this->uri; // @fixme accurate?
-            return $object;
+            return ActivityObject::fromGroup($this->localGroup());
         } else {
             return ActivityObject::fromProfile($this->localProfile());
         }
@@ -189,57 +169,13 @@ class Ostatus_profile extends Memcached_DataObject
      */
     function asActivityNoun($element)
     {
-        $xs = new XMLStringer(true);
-        $avatarHref = Avatar::defaultImage(AVATAR_PROFILE_SIZE);
-        $avatarType = 'image/png';
         if ($this->isGroup()) {
-            $type = 'http://activitystrea.ms/schema/1.0/group';
-            $self = $this->localGroup();
-
-            // @fixme put a standard getAvatar() interface on groups too
-            if ($self->homepage_logo) {
-                $avatarHref = $self->homepage_logo;
-                $map = array('png' => 'image/png',
-                             'jpg' => 'image/jpeg',
-                             'jpeg' => 'image/jpeg',
-                             'gif' => 'image/gif');
-                $extension = pathinfo(parse_url($avatarHref, PHP_URL_PATH), PATHINFO_EXTENSION);
-                if (isset($map[$extension])) {
-                    $avatarType = $map[$extension];
-                }
-            }
+            $noun = ActivityObject::fromGroup($this->localGroup());
+            return $noun->asString('activity:' . $element);
         } else {
-            $type = 'http://activitystrea.ms/schema/1.0/person';
-            $self = $this->localProfile();
-            $avatar = $self->getAvatar(AVATAR_PROFILE_SIZE);
-            if ($avatar) {
-                  $avatarHref = $avatar->url;
-                  $avatarType = $avatar->mediatype;
-            }
+            $noun = ActivityObject::fromProfile($this->localProfile());
+            return $noun->asString('activity:' . $element);
         }
-        $xs->elementStart('activity:' . $element);
-        $xs->element(
-            'activity:object-type',
-            null,
-            $type
-        );
-        $xs->element(
-            'id',
-            null,
-            $this->uri); // ?
-        $xs->element('title', null, $self->getBestName());
-
-        $xs->element(
-            'link', array(
-                'type' => $avatarType,
-                'href' => $avatarHref
-            ),
-            ''
-        );
-
-        $xs->elementEnd('activity:' . $element);
-
-        return $xs->getString();
     }
 
     /**
@@ -332,6 +268,9 @@ class Ostatus_profile extends Memcached_DataObject
      */
     public function unsubscribe() {
         $feedsub = FeedSub::staticGet('uri', $this->feeduri);
+        if (!$feedsub) {
+            return true;
+        }
         if ($feedsub->sub_state == 'active') {
             return $feedsub->unsubscribe();
         } else if ($feedsub->sub_state == '' || $feedsub->sub_state == 'inactive' || $feedsub->sub_state == 'unsubscribe') {
@@ -356,7 +295,7 @@ class Ostatus_profile extends Memcached_DataObject
             $count = $this->localProfile()->subscriberCount();
         }
         if ($count == 0) {
-            common_log(LOG_INFO, "Unsubscribing from now-unused remote feed $oprofile->feeduri");
+            common_log(LOG_INFO, "Unsubscribing from now-unused remote feed $this->feeduri");
             $this->unsubscribe();
             return true;
         } else {
@@ -398,7 +337,8 @@ class Ostatus_profile extends Memcached_DataObject
                                 'xmlns:thr' => 'http://purl.org/syndication/thread/1.0',
                                 'xmlns:georss' => 'http://www.georss.org/georss',
                                 'xmlns:ostatus' => 'http://ostatus.org/schema/1.0',
-                                'xmlns:poco' => 'http://portablecontacts.net/spec/1.0');
+                                'xmlns:poco' => 'http://portablecontacts.net/spec/1.0',
+                                'xmlns:media' => 'http://purl.org/syndication/atommedia');
 
             $entry = new XMLStringer();
             $entry->elementStart('entry', $attributes);
@@ -417,7 +357,7 @@ class Ostatus_profile extends Memcached_DataObject
             common_log(LOG_INFO, "Posting to Salmon endpoint $this->salmonuri: $xml");
 
             $salmon = new Salmon(); // ?
-            return $salmon->post($this->salmonuri, $xml);
+            return $salmon->post($this->salmonuri, $xml, $actor);
         }
         return false;
     }
@@ -429,11 +369,11 @@ class Ostatus_profile extends Memcached_DataObject
      * @param mixed $entry XML string, Notice, or Activity
      * @return boolean success
      */
-    public function notifyActivity($entry)
+    public function notifyActivity($entry, $actor)
     {
         if ($this->salmonuri) {
             $salmon = new Salmon();
-            return $salmon->post($this->salmonuri, $this->notifyPrepXml($entry));
+            return $salmon->post($this->salmonuri, $this->notifyPrepXml($entry), $actor);
         }
 
         return false;
@@ -446,11 +386,12 @@ class Ostatus_profile extends Memcached_DataObject
      * @param mixed $entry XML string, Notice, or Activity
      * @return boolean success
      */
-    public function notifyDeferred($entry)
+    public function notifyDeferred($entry, $actor)
     {
         if ($this->salmonuri) {
             $data = array('salmonuri' => $this->salmonuri,
-                          'entry' => $this->notifyPrepXml($entry));
+                          'entry' => $this->notifyPrepXml($entry),
+                          'actor' => $actor->id);
 
             $qm = QueueManager::get();
             return $qm->enqueue($data, 'salmon');
@@ -482,45 +423,23 @@ class Ostatus_profile extends Memcached_DataObject
         }
     }
 
-    function atomFeed($actor)
-    {
-        $feed = new Atom10Feed();
-        // @fixme should these be set up somewhere else?
-        $feed->addNamespace('activity', 'http://activitystrea.ms/spec/1.0/');
-        $feed->addNamespace('thr', 'http://purl.org/syndication/thread/1.0');
-        $feed->addNamespace('georss', 'http://www.georss.org/georss');
-        $feed->addNamespace('ostatus', 'http://ostatus.org/schema/1.0');
-
-        $taguribase = common_config('integration', 'taguri');
-        $feed->setId("tag:{$taguribase}:UserTimeline:{$actor->id}"); // ???
-
-        $feed->setTitle($actor->getBestName() . ' timeline'); // @fixme
-        $feed->setUpdated(time());
-        $feed->setPublished(time());
-
-        $feed->addLink(common_local_url('ApiTimelineUser',
-                                        array('id' => $actor->id,
-                                              'type' => 'atom')),
-                       array('rel' => 'self',
-                             'type' => 'application/atom+xml'));
-
-        $feed->addLink(common_local_url('userbyid',
-                                        array('id' => $actor->id)),
-                       array('rel' => 'alternate',
-                             'type' => 'text/html'));
-
-        return $feed;
-    }
-
     /**
      * Read and post notices for updates from the feed.
      * Currently assumes that all items in the feed are new,
      * coming from a PuSH hub.
      *
-     * @param DOMDocument $feed
+     * @param DOMDocument $doc
+     * @param string $source identifier ("push")
      */
-    public function processFeed($feed, $source)
+    public function processFeed(DOMDocument $doc, $source)
     {
+        $feed = $doc->documentElement;
+
+        if ($feed->localName != 'feed' || $feed->namespaceURI != Activity::ATOM) {
+            common_log(LOG_ERR, __METHOD__ . ": not an Atom feed, ignoring");
+            return;
+        }
+
         $entries = $feed->getElementsByTagNameNS(Activity::ATOM, 'entry');
         if ($entries->length == 0) {
             common_log(LOG_ERR, __METHOD__ . ": no entries in feed update, ignoring");
@@ -538,6 +457,7 @@ class Ostatus_profile extends Memcached_DataObject
      *
      * @param DOMElement $entry
      * @param DOMElement $feed for context
+     * @param string $source identifier ("push" or "salmon")
      */
     public function processEntry($entry, $feed, $source)
     {
@@ -607,12 +527,40 @@ class Ostatus_profile extends Memcached_DataObject
         $rendered = $this->purify($activity->object->content);
         $content = html_entity_decode(strip_tags($rendered));
 
+        $shortened = common_shorten_links($content);
+
+        // If it's too long, try using the summary, and make the
+        // HTML an attachment.
+
+        $attachment = null;
+
+        if (Notice::contentTooLong($shortened)) {
+            $attachment = $this->saveHTMLFile($activity->object->title, $rendered);
+            $summary = $activity->object->summary;
+            if (empty($summary)) {
+                $summary = $content;
+            }
+            $shortSummary = common_shorten_links($summary);
+            if (Notice::contentTooLong($shortSummary)) {
+                $url = common_shorten_url(common_local_url('attachment',
+                                                           array('attachment' => $attachment->id)));
+                $shortSummary = substr($shortSummary,
+                                       0,
+                                       Notice::maxContent() - (mb_strlen($url) + 2));
+                $shortSummary .= '… ' . $url;
+                $content = $shortSummary;
+                $rendered = common_render_text($content);
+            }
+        }
+
         $options = array('is_local' => Notice::REMOTE_OMB,
                         'url' => $sourceUrl,
                         'uri' => $sourceUri,
                         'rendered' => $rendered,
                         'replies' => array(),
-                        'groups' => array());
+                        'groups' => array(),
+                        'tags' => array(),
+                        'urls' => array());
 
         // Check for optional attributes...
 
@@ -647,6 +595,22 @@ class Ostatus_profile extends Memcached_DataObject
             }
         }
 
+        // Atom categories <-> hashtags
+        foreach ($activity->categories as $cat) {
+            if ($cat->term) {
+                $term = common_canonical_tag($cat->term);
+                if ($term) {
+                    $options['tags'][] = $term;
+                }
+            }
+        }
+
+        // Atom enclosures -> attachment URLs
+        foreach ($activity->enclosures as $href) {
+            // @fixme save these locally or....?
+            $options['urls'][] = $href;
+        }
+
         try {
             $saved = Notice::saveNew($oprofile->profile_id,
                                      $content,
@@ -654,6 +618,9 @@ class Ostatus_profile extends Memcached_DataObject
                                      $options);
             if ($saved) {
                 Ostatus_source::saveNew($saved, $this, $method);
+                if (!empty($attachment)) {
+                    File_to_post::processNew($attachment->id, $saved->id);
+                }
             }
         } catch (Exception $e) {
             common_log(LOG_ERR, "OStatus save of remote message $sourceUri failed: " . $e->getMessage());
@@ -669,7 +636,8 @@ class Ostatus_profile extends Memcached_DataObject
     protected function purify($html)
     {
         require_once INSTALLDIR.'/extlib/htmLawed/htmLawed.php';
-        $config = array('safe' => 1);
+        $config = array('safe' => 1,
+                        'deny_attribute' => 'id,style,on*');
         return htmLawed($html, $config);
     }
 
@@ -747,11 +715,18 @@ class Ostatus_profile extends Memcached_DataObject
     {
         // Get the canonical feed URI and check it
         $discover = new FeedDiscovery();
-        $feeduri = $discover->discoverFromURL($profile_uri);
+        if (isset($hints['feedurl'])) {
+            $feeduri = $hints['feedurl'];
+            $feeduri = $discover->discoverFromFeedURL($feeduri);
+        } else {
+            $feeduri = $discover->discoverFromURL($profile_uri);
+            $hints['feedurl'] = $feeduri;
+        }
 
-        //$feedsub = FeedSub::ensureFeed($feeduri, $discover->feed);
         $huburi = $discover->getAtomLink('hub');
-        $salmonuri = $discover->getAtomLink('salmon');
+        $hints['hub'] = $huburi;
+        $salmonuri = $discover->getAtomLink(Salmon::NS_REPLIES);
+        $hints['salmon'] = $salmonuri;
 
         if (!$huburi) {
             // We can only deal with folks with a PuSH hub
@@ -766,7 +741,7 @@ class Ostatus_profile extends Memcached_DataObject
 
         if (!empty($subject)) {
             $subjObject = new ActivityObject($subject);
-            return self::ensureActivityObjectProfile($subjObject, $feeduri, $salmonuri, $hints);
+            return self::ensureActivityObjectProfile($subjObject, $hints);
         }
 
         // Otherwise, try the feed author
@@ -775,7 +750,7 @@ class Ostatus_profile extends Memcached_DataObject
 
         if (!empty($author)) {
             $authorObject = new ActivityObject($author);
-            return self::ensureActivityObjectProfile($authorObject, $feeduri, $salmonuri, $hints);
+            return self::ensureActivityObjectProfile($authorObject, $hints);
         }
 
         // Sheesh. Not a very nice feed! Let's try fingerpoken in the
@@ -791,7 +766,7 @@ class Ostatus_profile extends Memcached_DataObject
 
             if (!empty($actor)) {
                 $actorObject = new ActivityObject($actor);
-                return self::ensureActivityObjectProfile($actorObject, $feeduri, $salmonuri, $hints);
+                return self::ensureActivityObjectProfile($actorObject, $hints);
 
             }
 
@@ -799,7 +774,7 @@ class Ostatus_profile extends Memcached_DataObject
 
             if (!empty($author)) {
                 $authorObject = new ActivityObject($author);
-                return self::ensureActivityObjectProfile($authorObject, $feeduri, $salmonuri, $hints);
+                return self::ensureActivityObjectProfile($authorObject, $hints);
             }
         }
 
@@ -868,8 +843,20 @@ class Ostatus_profile extends Memcached_DataObject
 
     protected static function getActivityObjectAvatar($object, $hints=array())
     {
-        if ($object->avatar) {
-            return $object->avatar;
+        if ($object->avatarLinks) {
+            $best = false;
+            // Take the exact-size avatar, or the largest avatar, or the first avatar if all sizeless
+            foreach ($object->avatarLinks as $avatar) {
+                if ($avatar->width == AVATAR_PROFILE_SIZE && $avatar->height = AVATAR_PROFILE_SIZE) {
+                    // Exact match!
+                    $best = $avatar;
+                    break;
+                }
+                if (!$best || $avatar->width > $best->width) {
+                    $best = $avatar;
+                }
+            }
+            return $best->url;
         } else if (array_key_exists('avatar', $hints)) {
             return $hints['avatar'];
         }
@@ -932,18 +919,18 @@ class Ostatus_profile extends Memcached_DataObject
      * @return Ostatus_profile
      */
 
-    public static function ensureActorProfile($activity, $feeduri=null, $salmonuri=null)
+    public static function ensureActorProfile($activity, $hints=array())
     {
-        return self::ensureActivityObjectProfile($activity->actor, $feeduri, $salmonuri);
+        return self::ensureActivityObjectProfile($activity->actor, $hints);
     }
 
-    public static function ensureActivityObjectProfile($object, $feeduri=null, $salmonuri=null, $hints=array())
+    public static function ensureActivityObjectProfile($object, $hints=array())
     {
         $profile = self::getActivityObjectProfile($object);
         if ($profile) {
             $profile->updateFromActivityObject($object, $hints);
         } else {
-            $profile = self::createActivityObjectProfile($object, $feeduri, $salmonuri, $hints);
+            $profile = self::createActivityObjectProfile($object, $hints);
         }
         return $profile;
     }
@@ -989,58 +976,55 @@ class Ostatus_profile extends Memcached_DataObject
      * @fixme validate stuff somewhere
      */
 
-    protected static function createActorProfile($activity, $feeduri=null, $salmonuri=null)
-    {
-        $actor = $activity->actor;
-
-        self::createActivityObjectProfile($actor, $feeduri, $salmonuri);
-    }
-
     /**
      * Create local ostatus_profile and profile/user_group entries for
      * the provided remote user or group.
      *
      * @param ActivityObject $object
-     * @param string $feeduri
-     * @param string $salmonuri
      * @param array $hints
      *
-     * @fixme fold $feeduri/$salmonuri into $hints
      * @return Ostatus_profile
      */
-    protected static function createActivityObjectProfile($object, $feeduri=null, $salmonuri=null, $hints=array())
+    protected static function createActivityObjectProfile($object, $hints=array())
     {
-        $homeuri  = $object->id;
+        $homeuri = $object->id;
+        $discover = false;
 
         if (!$homeuri) {
             common_log(LOG_DEBUG, __METHOD__ . " empty actor profile URI: " . var_export($activity, true));
             throw new ServerException("No profile URI");
         }
 
-        if (empty($feeduri)) {
-            if (array_key_exists('feedurl', $hints)) {
-                $feeduri = $hints['feedurl'];
-            }
+        if (array_key_exists('feedurl', $hints)) {
+            $feeduri = $hints['feedurl'];
+        } else {
+            $discover = new FeedDiscovery();
+            $feeduri = $discover->discoverFromURL($homeuri);
         }
 
-        if (empty($salmonuri)) {
-            if (array_key_exists('salmon', $hints)) {
-                $salmonuri = $hints['salmon'];
+        if (array_key_exists('salmon', $hints)) {
+            $salmonuri = $hints['salmon'];
+        } else {
+            if (!$discover) {
+                $discover = new FeedDiscovery();
+                $discover->discoverFromFeedURL($hints['feedurl']);
             }
+            $salmonuri = $discover->getAtomLink(Salmon::NS_REPLIES);
         }
 
-        if (!$feeduri || !$salmonuri) {
-            // Get the canonical feed URI and check it
-            $discover = new FeedDiscovery();
-            $feeduri = $discover->discoverFromURL($homeuri);
-
+        if (array_key_exists('hub', $hints)) {
+            $huburi = $hints['hub'];
+        } else {
+            if (!$discover) {
+                $discover = new FeedDiscovery();
+                $discover->discoverFromFeedURL($hints['feedurl']);
+            }
             $huburi = $discover->getAtomLink('hub');
-            $salmonuri = $discover->getAtomLink('salmon');
+        }
 
-            if (!$huburi) {
-                // We can only deal with folks with a PuSH hub
-                throw new FeedSubNoHubException();
-            }
+        if (!$huburi) {
+            // We can only deal with folks with a PuSH hub
+            throw new FeedSubNoHubException();
         }
 
         $oprofile = new Ostatus_profile();
@@ -1054,8 +1038,8 @@ class Ostatus_profile extends Memcached_DataObject
 
         if ($object->type == ActivityObject::PERSON) {
             $profile = new Profile();
+            $profile->created = common_sql_now();
             self::updateProfile($profile, $object, $hints);
-            $profile->created  = common_sql_now();
 
             $oprofile->profile_id = $profile->insert();
             if (!$oprofile->profile_id) {
@@ -1063,6 +1047,7 @@ class Ostatus_profile extends Memcached_DataObject
             }
         } else {
             $group = new User_group();
+            $group->uri = $homeuri;
             $group->created = common_sql_now();
             self::updateGroup($group, $object, $hints);
 
@@ -1110,18 +1095,35 @@ class Ostatus_profile extends Memcached_DataObject
         $orig = clone($profile);
 
         $profile->nickname = self::getActivityObjectNickname($object, $hints);
-        $profile->fullname = $object->title;
+
+        if (!empty($object->title)) {
+            $profile->fullname = $object->title;
+        } else if (array_key_exists('fullname', $hints)) {
+            $profile->fullname = $hints['fullname'];
+        }
+
         if (!empty($object->link)) {
             $profile->profileurl = $object->link;
         } else if (array_key_exists('profileurl', $hints)) {
             $profile->profileurl = $hints['profileurl'];
+        } else if (Validate::uri($object->id, array('allowed_schemes' => array('http', 'https')))) {
+            $profile->profileurl = $object->id;
+        }
+
+        $profile->bio      = self::getActivityObjectBio($object, $hints);
+        $profile->location = self::getActivityObjectLocation($object, $hints);
+        $profile->homepage = self::getActivityObjectHomepage($object, $hints);
+
+        if (!empty($object->geopoint)) {
+            $location = ActivityContext::locationFromPoint($object->geopoint);
+            if (!empty($location)) {
+                $profile->lat = $location->lat;
+                $profile->lon = $location->lon;
+            }
         }
 
-        // @fixme bio
         // @fixme tags/categories
-        // @fixme location?
         // @todo tags from categories
-        // @todo lat/lon/location?
 
         if ($profile->id) {
             common_log(LOG_DEBUG, "Updating OStatus profile $profile->id from remote info $object->id: " . var_export($object, true) . var_export($hints, true));
@@ -1133,19 +1135,19 @@ class Ostatus_profile extends Memcached_DataObject
     {
         $orig = clone($group);
 
-        // @fixme need to make nick unique etc *hack hack*
         $group->nickname = self::getActivityObjectNickname($object, $hints);
         $group->fullname = $object->title;
 
-        // @fixme no canonical profileurl; using homepage instead for now
-        $group->homepage = $object->id;
+        if (!empty($object->link)) {
+            $group->mainpage = $object->link;
+        } else if (array_key_exists('profileurl', $hints)) {
+            $group->mainpage = $hints['profileurl'];
+        }
 
-        // @fixme homepage
-        // @fixme bio
-        // @fixme tags/categories
-        // @fixme location?
         // @todo tags from categories
-        // @todo lat/lon/location?
+        $group->description = self::getActivityObjectBio($object, $hints);
+        $group->location = self::getActivityObjectLocation($object, $hints);
+        $group->homepage = self::getActivityObjectHomepage($object, $hints);
 
         if ($group->id) {
             common_log(LOG_DEBUG, "Updating OStatus group $group->id from remote info $object->id: " . var_export($object, true) . var_export($hints, true));
@@ -1153,6 +1155,69 @@ class Ostatus_profile extends Memcached_DataObject
         }
     }
 
+    protected static function getActivityObjectHomepage($object, $hints=array())
+    {
+        $homepage = null;
+        $poco     = $object->poco;
+
+        if (!empty($poco)) {
+            $url = $poco->getPrimaryURL();
+            if ($url && $url->type == 'homepage') {
+                $homepage = $url->value;
+            }
+        }
+
+        // @todo Try for a another PoCo URL?
+
+        return $homepage;
+    }
+
+    protected static function getActivityObjectLocation($object, $hints=array())
+    {
+        $location = null;
+
+        if (!empty($object->poco) &&
+            isset($object->poco->address->formatted)) {
+            $location = $object->poco->address->formatted;
+        } else if (array_key_exists('location', $hints)) {
+            $location = $hints['location'];
+        }
+
+        if (!empty($location)) {
+            if (mb_strlen($location) > 255) {
+                $location = mb_substr($note, 0, 255 - 3) . ' … ';
+            }
+        }
+
+        // @todo Try to find location some othe way? Via goerss point?
+
+        return $location;
+    }
+
+    protected static function getActivityObjectBio($object, $hints=array())
+    {
+        $bio  = null;
+
+        if (!empty($object->poco)) {
+            $note = $object->poco->note;
+        } else if (array_key_exists('bio', $hints)) {
+            $note = $hints['bio'];
+        }
+
+        if (!empty($note)) {
+            if (Profile::bioTooLong($note)) {
+                // XXX: truncate ok?
+                $bio = mb_substr($note, 0, Profile::maxBio() - 3) . ' … ';
+            } else {
+                $bio = $note;
+            }
+        }
+
+        // @todo Try to get bio info some other way?
+
+        return $bio;
+    }
+
     protected static function getActivityObjectNickname($object, $hints=array())
     {
         if ($object->poco) {
@@ -1160,10 +1225,15 @@ class Ostatus_profile extends Memcached_DataObject
                 return common_nicknamize($object->poco->preferredUsername);
             }
         }
+
         if (!empty($object->nickname)) {
             return common_nicknamize($object->nickname);
         }
 
+        if (array_key_exists('nickname', $hints)) {
+            return $hints['nickname'];
+        }
+
         // Try the definitive ID
 
         $nickname = self::nicknameFromURI($object->id);
@@ -1206,36 +1276,65 @@ class Ostatus_profile extends Memcached_DataObject
         }
     }
 
+    /**
+     * @param string $addr webfinger address
+     * @return Ostatus_profile
+     * @throws Exception on error conditions
+     */
     public static function ensureWebfinger($addr)
     {
+        // First, try the cache
+
+        $uri = self::cacheGet(sprintf('ostatus_profile:webfinger:%s', $addr));
+
+        if ($uri !== false) {
+            if (is_null($uri)) {
+                // Negative cache entry
+                throw new Exception('Not a valid webfinger address.');
+            }
+            $oprofile = Ostatus_profile::staticGet('uri', $uri);
+            if (!empty($oprofile)) {
+                return $oprofile;
+            }
+        }
+
         // First, look it up
 
         $oprofile = Ostatus_profile::staticGet('uri', 'acct:'.$addr);
 
         if (!empty($oprofile)) {
+            self::cacheSet(sprintf('ostatus_profile:webfinger:%s', $addr), $oprofile->uri);
             return $oprofile;
         }
 
         // Now, try some discovery
 
-        $wf = new Webfinger();
+        $disco = new Discovery();
 
-        $result = $wf->lookup($addr);
-
-        if (!$result) {
-            return null;
+        try {
+            $result = $disco->lookup($addr);
+        } catch (Exception $e) {
+            // Save negative cache entry so we don't waste time looking it up again.
+            // @fixme distinguish temporary failures?
+            self::cacheSet(sprintf('ostatus_profile:webfinger:%s', $addr), null);
+            throw new Exception('Not a valid webfinger address.');
         }
 
+        $hints = array('webfinger' => $addr);
+
         foreach ($result->links as $link) {
             switch ($link['rel']) {
-            case Webfinger::PROFILEPAGE:
-                $profileUrl = $link['href'];
+            case Discovery::PROFILEPAGE:
+                $hints['profileurl'] = $profileUrl = $link['href'];
                 break;
-            case 'salmon':
-                $salmonEndpoint = $link['href'];
+            case Salmon::NS_REPLIES:
+                $hints['salmon'] = $salmonEndpoint = $link['href'];
                 break;
-            case Webfinger::UPDATESFROM:
-                $feedUrl = $link['href'];
+            case Discovery::UPDATESFROM:
+                $hints['feedurl'] = $feedUrl = $link['href'];
+                break;
+            case Discovery::HCARD:
+                $hcardUrl = $link['href'];
                 break;
             default:
                 common_log(LOG_NOTICE, "Don't know what to do with rel = '{$link['rel']}'");
@@ -1243,16 +1342,19 @@ class Ostatus_profile extends Memcached_DataObject
             }
         }
 
-        $hints = array('webfinger' => $addr,
-                       'profileurl' => $profileUrl,
-                       'feedurl' => $feedUrl,
-                       'salmon' => $salmonEndpoint);
+        if (isset($hcardUrl)) {
+            $hcardHints = self::slurpHcard($hcardUrl);
+            // Note: Webfinger > hcard
+            $hints = array_merge($hcardHints, $hints);
+        }
 
         // If we got a feed URL, try that
 
         if (isset($feedUrl)) {
             try {
+                common_log(LOG_INFO, "Discovery on acct:$addr with feed URL $feedUrl");
                 $oprofile = self::ensureProfile($feedUrl, $hints);
+                self::cacheSet(sprintf('ostatus_profile:webfinger:%s', $addr), $oprofile->uri);
                 return $oprofile;
             } catch (Exception $e) {
                 common_log(LOG_WARNING, "Failed creating profile from feed URL '$feedUrl': " . $e->getMessage());
@@ -1264,7 +1366,9 @@ class Ostatus_profile extends Memcached_DataObject
 
         if (isset($profileUrl)) {
             try {
+                common_log(LOG_INFO, "Discovery on acct:$addr with profile URL $profileUrl");
                 $oprofile = self::ensureProfile($profileUrl, $hints);
+                self::cacheSet(sprintf('ostatus_profile:webfinger:%s', $addr), $oprofile->uri);
                 return $oprofile;
             } catch (Exception $e) {
                 common_log(LOG_WARNING, "Failed creating profile from profile URL '$profileUrl': " . $e->getMessage());
@@ -1316,9 +1420,106 @@ class Ostatus_profile extends Memcached_DataObject
                 throw new Exception("Couldn't save ostatus_profile for '$addr'");
             }
 
+            self::cacheSet(sprintf('ostatus_profile:webfinger:%s', $addr), $oprofile->uri);
             return $oprofile;
         }
 
-        return null;
+        throw new Exception("Couldn't find a valid profile for '$addr'");
+    }
+
+    function saveHTMLFile($title, $rendered)
+    {
+        $final = sprintf("<!DOCTYPE html>\n<html><head><title>%s</title></head>".
+                         '<body><div>%s</div></body></html>',
+                         htmlspecialchars($title),
+                         $rendered);
+
+        $filename = File::filename($this->localProfile(),
+                                   'ostatus', // ignored?
+                                   'text/html');
+
+        $filepath = File::path($filename);
+
+        file_put_contents($filepath, $final);
+
+        $file = new File;
+
+        $file->filename = $filename;
+        $file->url      = File::url($filename);
+        $file->size     = filesize($filepath);
+        $file->date     = time();
+        $file->mimetype = 'text/html';
+
+        $file_id = $file->insert();
+
+        if ($file_id === false) {
+            common_log_db_error($file, "INSERT", __FILE__);
+            throw new ServerException(_('Could not store HTML content of long post as file.'));
+        }
+
+        return $file;
+    }
+
+    protected static function slurpHcard($url)
+    {
+        set_include_path(get_include_path() . PATH_SEPARATOR . INSTALLDIR . '/plugins/OStatus/extlib/hkit/');
+        require_once('hkit.class.php');
+
+        $h	= new hKit;
+
+        // Google Buzz hcards need to be tidied. Probably others too.
+
+        $h->tidy_mode = 'proxy'; // 'proxy', 'exec', 'php' or 'none'
+
+        // Get by URL
+        $hcards = $h->getByURL('hcard', $url);
+
+        if (empty($hcards)) {
+            return array();
+        }
+
+        // @fixme more intelligent guess on multi-hcard pages
+        $hcard = $hcards[0];
+
+        $hints = array();
+
+        $hints['profileurl'] = $url;
+
+        if (array_key_exists('nickname', $hcard)) {
+            $hints['nickname'] = $hcard['nickname'];
+        }
+
+        if (array_key_exists('fn', $hcard)) {
+            $hints['fullname'] = $hcard['fn'];
+        } else if (array_key_exists('n', $hcard)) {
+            $hints['fullname'] = implode(' ', $hcard['n']);
+        }
+
+        if (array_key_exists('photo', $hcard)) {
+            $hints['avatar'] = $hcard['photo'];
+        }
+
+        if (array_key_exists('note', $hcard)) {
+            $hints['bio'] = $hcard['note'];
+        }
+
+        if (array_key_exists('adr', $hcard)) {
+            if (is_string($hcard['adr'])) {
+                $hints['location'] = $hcard['adr'];
+            } else if (is_array($hcard['adr'])) {
+                $hints['location'] = implode(' ', $hcard['adr']);
+            }
+        }
+
+        if (array_key_exists('url', $hcard)) {
+            if (is_string($hcard['url'])) {
+                $hints['homepage'] = $hcard['url'];
+            } else if (is_array($hcard['url'])) {
+                // HACK get the last one; that's how our hcards look
+                $hints['homepage'] = $hcard['url'][count($hcard['url'])-1];
+            }
+        }
+
+        return $hints;
     }
 }
diff --git a/plugins/OStatus/extlib/hkit/hcard.profile.php b/plugins/OStatus/extlib/hkit/hcard.profile.php
new file mode 100644
index 000000000..6ec0dc890
--- /dev/null
+++ b/plugins/OStatus/extlib/hkit/hcard.profile.php
@@ -0,0 +1,105 @@
+<?php
+	// hcard profile for hkit
+	
+	$this->root_class = 'vcard';
+	
+	$this->classes = array( 
+		'fn', array('honorific-prefix', 'given-name', 'additional-name', 'family-name', 'honorific-suffix'),
+		'n', array('honorific-prefix', 'given-name', 'additional-name', 'family-name', 'honorific-suffix'),
+		'adr', array('post-office-box', 'extended-address', 'street-address', 'postal-code', 'country-name', 'type', 'region', 'locality'),
+		'label', 'bday', 'agent', 'nickname', 'photo', 'class', 
+		'email', array('type', 'value'), 
+		'category', 'key', 'logo', 'mailer', 'note',
+		'org', array('organization-name', 'organization-unit'),
+		'tel', array('type', 'value'),
+		'geo', array('latitude', 'longitude'),
+		'tz', 'uid', 'url', 'rev', 'role', 'sort-string', 'sound', 'title'		
+	);
+	
+	// classes that must only appear once per card
+	$this->singles = array(
+		'fn'
+	);
+	
+	// classes that are required (not strictly enforced - give at least one!)
+	$this->required = array(
+		'fn'
+	);
+
+	$this->att_map = array(
+		'fn'	=> array('IMG|alt'),
+		'url'	=> array('A|href', 'IMG|src', 'AREA|href'),
+		'photo'	=> array('IMG|src'),
+		'bday'	=> array('ABBR|title'),
+		'logo'	=> array('IMG|src'),
+		'email' => array('A|href'),
+		'geo'	=> array('ABBR|title')
+	);
+
+	
+	$this->callbacks = array(
+		'url'	=> array($this, 'resolvePath'),
+		'photo'	=> array($this, 'resolvePath'),
+		'logo'	=> array($this, 'resolvePath'),
+		'email'	=> array($this, 'resolveEmail')
+	);
+
+
+
+	function hKit_hcard_post($a)
+	{
+		
+		foreach ($a as &$vcard){
+			
+			hKit_implied_n_optimization($vcard);
+			hKit_implied_n_from_fn($vcard);
+			
+		}
+		
+		return $a;
+	
+	}
+	
+	
+	function hKit_implied_n_optimization(&$vcard)
+	{
+		if (array_key_exists('fn', $vcard) && !is_array($vcard['fn']) && 
+			!array_key_exists('n', $vcard) && (!array_key_exists('org', $vcard) || $vcard['fn'] != $vcard['org'])){
+			
+			if (sizeof(explode(' ', $vcard['fn'])) == 2){
+				$patterns	= array();
+				$patterns[] = array('/^(\S+),\s*(\S{1})$/', 2, 1); 		// Lastname, Initial
+				$patterns[] = array('/^(\S+)\s*(\S{1})\.*$/', 2, 1); 	// Lastname Initial(.)
+				$patterns[] = array('/^(\S+),\s*(\S+)$/', 2, 1); 		// Lastname, Firstname
+				$patterns[] = array('/^(\S+)\s*(\S+)$/', 1, 2); 		// Firstname Lastname
+			
+				foreach ($patterns as $pattern){
+					if (preg_match($pattern[0], $vcard['fn'], $matches) === 1){
+						$n					= array();
+						$n['given-name']	= $matches[$pattern[1]];
+						$n['family-name']	= $matches[$pattern[2]];
+						$vcard['n']			= $n;
+						
+						
+						break;
+					}
+				}
+			}
+		}
+	}
+	
+	
+	function hKit_implied_n_from_fn(&$vcard)
+	{
+		if (array_key_exists('fn', $vcard) && is_array($vcard['fn']) 
+			&& !array_key_exists('n', $vcard) && (!array_key_exists('org', $vcard) || $vcard['fn'] != $vcard['org'])){
+				
+			$vcard['n']		= $vcard['fn'];
+		}
+
+		if (array_key_exists('fn', $vcard) && is_array($vcard['fn'])){
+			$vcard['fn']	= $vcard['fn']['text'];
+		}
+	}
+
+?>
\ No newline at end of file
diff --git a/plugins/OStatus/extlib/hkit/hkit.class.php b/plugins/OStatus/extlib/hkit/hkit.class.php
new file mode 100644
index 000000000..c3a54cff6
--- /dev/null
+++ b/plugins/OStatus/extlib/hkit/hkit.class.php
@@ -0,0 +1,475 @@
+<?php
+
+	/* 
+	
+	hKit Library for PHP5 - a generic library for parsing Microformats
+	Copyright (C) 2006  Drew McLellan
+
+	This library is free software; you can redistribute it and/or
+	modify it under the terms of the GNU Lesser General Public
+	License as published by the Free Software Foundation; either
+	version 2.1 of the License, or (at your option) any later version.
+
+	This library is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+	Lesser General Public License for more details.
+
+	You should have received a copy of the GNU Lesser General Public
+	License along with this library; if not, write to the Free Software
+	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+	
+	Author	
+		Drew McLellan - http://allinthehead.com/
+		
+	Contributors:
+		Scott Reynen - http://www.randomchaos.com/
+		
+	Version 0.5, 22-Jul-2006
+		fixed by-ref issue cropping up in PHP 5.0.5
+		fixed a bug with a@title
+		added support for new fn=n optimisation
+		added support for new a.include include-pattern
+	Version 0.4, 23-Jun-2006
+		prevented nested includes from causing infinite loops
+		returns false if URL can't be fetched
+		added pre-flight check for base support level
+		added deduping of once-only classnames
+		prevented accumulation of multiple 'value' values
+		tuned whitespace handling and treatment of DEL elements
+	Version 0.3, 21-Jun-2006
+		added post-processor callback method into profiles
+		fixed minor problems raised by hcard testsuite
+		added support for include-pattern
+		added support for td@headers pattern
+		added implied-n optimization into default hcard profile
+	Version 0.2, 20-Jun-2006
+		added class callback mechanism
+		added resolvePath & resolveEmail
+		added basic BASE support
+	Version 0.1.1, 19-Jun-2006 (different timezone, no time machine)
+		added external Tidy option
+	Version 0.1, 20-Jun-2006
+		initial release
+		
+	
+	
+	
+	*/
+
+	class hKit
+	{
+		
+		public $tidy_mode	= 'proxy'; // 'proxy', 'exec', 'php' or 'none'
+		public $tidy_proxy	= 'http://cgi.w3.org/cgi-bin/tidy?forceXML=on&docAddr='; // required only for tidy_mode=proxy
+		public $tmp_dir		= '/path/to/writable/dir/'; // required only for tidy_mode=exec
+		
+		private $root_class = '';
+		private $classes	= '';
+		private $singles	= '';
+		private $required	= '';
+		private $att_map	= '';
+		private $callbacks	= '';
+		private $processor 	= '';
+		
+		private $url		= '';
+		private $base 		= '';
+		private $doc		= '';
+		
+		
+		public function hKit()
+		{
+			// pre-flight checks
+			$pass 		= true; 
+			$required	= array('dom_import_simplexml', 'file_get_contents', 'simplexml_load_string');
+			$missing	= array();
+			
+			foreach ($required as $f){
+				if (!function_exists($f)){
+					$pass		= false;
+					$missing[] 	= $f . '()';
+				}
+			}
+			
+			if (!$pass)
+				die('hKit error: these required functions are not available: <strong>' . implode(', ', $missing) . '</strong>');
+			
+		}
+		
+
+		public function getByURL($profile='', $url='')
+		{
+			
+			if ($profile=='' || $url == '') return false;
+			
+			$this->loadProfile($profile);
+			
+			$source		= $this->loadURL($url);
+			
+			if ($source){
+				$tidy_xhtml	= $this->tidyThis($source);
+
+				$fragment	= false;
+			
+				if (strrchr($url, '#'))
+				$fragment	= array_pop(explode('#', $url));
+			
+				$doc		= $this->loadDoc($tidy_xhtml, $fragment);
+				$s			= $this->processNodes($doc, $this->classes);
+				$s			= $this->postProcess($profile, $s);
+			
+				return $s;
+			}else{
+				return false;
+			}
+		}
+		
+		public function getByString($profile='', $input_xml='')
+		{
+			if ($profile=='' || $input_xml == '') return false;
+			
+			$this->loadProfile($profile);
+
+			$doc	= $this->loadDoc($input_xml);
+			$s		= $this->processNodes($doc, $this->classes);
+			$s		= $this->postProcess($profile, $s);
+			
+			return $s;
+			
+		}
+		
+		private function processNodes($items, $classes, $allow_includes=true){
+
+			$out	= array();
+
+			foreach($items as $item){
+				$data	= array();
+
+				for ($i=0; $i<sizeof($classes); $i++){
+					
+					if (!is_array($classes[$i])){
+
+						$xpath			= ".//*[contains(concat(' ',normalize-space(@class),' '),' " . $classes[$i] . " ')]";
+						$results		= $item->xpath($xpath);
+						
+						if ($results){
+							foreach ($results as $result){ 
+								if (isset($classes[$i+1]) && is_array($classes[$i+1])){
+									$nodes				= $this->processNodes($results, $classes[$i+1]);
+									if (sizeof($nodes) > 0){
+										$nodes = array_merge(array('text'=>$this->getNodeValue($result, $classes[$i])), $nodes);
+										$data[$classes[$i]]	= $nodes;
+									}else{
+										$data[$classes[$i]]	= $this->getNodeValue($result, $classes[$i]);
+									}
+									
+								}else{								
+									if (isset($data[$classes[$i]])){
+										if (is_array($data[$classes[$i]])){
+											// is already an array - append
+											$data[$classes[$i]][]	= $this->getNodeValue($result, $classes[$i]);
+
+										}else{
+											// make it an array
+											if ($classes[$i] == 'value'){ // unless it's the 'value' of a type/value pattern
+												$data[$classes[$i]] .= $this->getNodeValue($result, $classes[$i]);
+											}else{
+												$old_val			= $data[$classes[$i]];
+												$data[$classes[$i]]	= array($old_val, $this->getNodeValue($result, $classes[$i]));
+												$old_val			= false;
+											}
+										}
+									}else{										
+										// set as normal value
+										$data[$classes[$i]]	= $this->getNodeValue($result, $classes[$i]);
+
+									}
+								}
+							
+								// td@headers pattern
+								if (strtoupper(dom_import_simplexml($result)->tagName)== "TD" && $result['headers']){
+									$include_ids	= explode(' ', $result['headers']);
+									$doc			= $this->doc;
+									foreach ($include_ids as $id){
+										$xpath			= "//*[@id='$id']/..";
+										$includes		= $doc->xpath($xpath);
+										foreach ($includes as $include){
+											$tmp = $this->processNodes($include, $this->classes);
+											if (is_array($tmp)) $data = array_merge($data, $tmp);
+										}
+									}
+								}
+							}					
+						}				
+					}
+					$result	= false;
+				}
+				
+				// include-pattern
+				if ($allow_includes){
+					$xpath			= ".//*[contains(concat(' ',normalize-space(@class),' '),' include ')]";
+					$results		= $item->xpath($xpath);
+				
+					if ($results){
+						foreach ($results as $result){
+							$tagName = strtoupper(dom_import_simplexml($result)->tagName);
+							if ((($tagName == "OBJECT" && $result['data']) || ($tagName == "A" && $result['href'])) 
+									&& preg_match('/\binclude\b/', $result['class'])){	
+								$att		= ($tagName == "OBJECT" ? 'data' : 'href');						
+								$id			= str_replace('#', '', $result[$att]);
+								$doc		= $this->doc;
+								$xpath		= "//*[@id='$id']";
+								$includes	= $doc->xpath($xpath);
+								foreach ($includes as $include){
+									$include	= simplexml_load_string('<root1><root2>'.$include->asXML().'</root2></root1>'); // don't ask.
+									$tmp 		= $this->processNodes($include, $this->classes, false);
+									if (is_array($tmp)) $data = array_merge($data, $tmp);
+								}
+							}
+						}
+					}
+				}
+				$out[]	= $data;
+			}
+			
+			if (sizeof($out) > 1){
+				return $out;
+			}else if (isset($data)){
+				return $data;
+			}else{
+				return array();
+			}
+		}
+
+
+		private function getNodeValue($node, $className)
+		{
+
+			$tag_name	= strtoupper(dom_import_simplexml($node)->tagName);
+			$s			= false;
+			
+			// ignore DEL tags
+			if ($tag_name == 'DEL') return $s;
+			
+			// look up att map values
+			if (array_key_exists($className, $this->att_map)){
+				
+				foreach ($this->att_map[$className] as $map){					
+					if (preg_match("/$tag_name\|/", $map)){
+						$s	= ''.$node[array_pop($foo = explode('|', $map))];
+					}
+				}
+			}
+			
+			// if nothing and OBJ, try data.
+			if (!$s && $tag_name=='OBJECT' && $node['data'])	$s	= ''.$node['data'];
+			
+			// if nothing and IMG, try alt.
+			if (!$s && $tag_name=='IMG' && $node['alt'])	$s	= ''.$node['alt'];
+			
+			// if nothing and AREA, try alt.
+			if (!$s && $tag_name=='AREA' && $node['alt'])	$s	= ''.$node['alt'];
+			
+			//if nothing and not A, try title.
+			if (!$s && $tag_name!='A' && $node['title'])	$s	= ''.$node['title'];
+				
+			
+			// if nothing found, go with node text
+			$s	= ($s ? $s : implode(array_filter($node->xpath('child::node()'), array(&$this, "filterBlankValues")), ' '));			
+
+			// callbacks			
+			if (array_key_exists($className, $this->callbacks)){
+				$s	= preg_replace_callback('/.*/', $this->callbacks[$className], $s, 1);
+			}
+			
+			// trim and remove line breaks
+			if ($tag_name != 'PRE'){
+				$s	= trim(preg_replace('/[\r\n\t]+/', '', $s));
+				$s	= trim(preg_replace('/(\s{2})+/', ' ', $s));
+			}
+			
+			return $s;
+		}
+
+		private function filterBlankValues($s){
+			return preg_match("/\w+/", $s);
+		}
+		
+		
+		private function tidyThis($source)
+		{
+			switch ( $this->tidy_mode )
+			{
+				case 'exec':
+					$tmp_file	= $this->tmp_dir.md5($source).'.txt';
+					file_put_contents($tmp_file, $source);
+					exec("tidy -utf8 -indent -asxhtml -numeric -bare -quiet $tmp_file", $tidy);
+					unlink($tmp_file);
+					return implode("\n", $tidy);
+				break;
+				
+				case 'php':
+					$tidy 	= tidy_parse_string($source);
+					return tidy_clean_repair($tidy);
+				break;
+						
+				default:
+					return $source;
+				break;
+			}
+			
+		}
+		
+		
+		private function loadProfile($profile)
+		{
+			require_once("$profile.profile.php");
+		}
+		
+		
+		private function loadDoc($input_xml, $fragment=false)
+		{
+			$xml 		= simplexml_load_string($input_xml);
+			
+			$this->doc	= $xml;
+			
+			if ($fragment){
+				$doc	= $xml->xpath("//*[@id='$fragment']");
+				$xml	= simplexml_load_string($doc[0]->asXML());
+				$doc	= null;
+			}
+			
+			// base tag
+			if ($xml->head->base['href']) $this->base = $xml->head->base['href'];			
+
+			// xml:base attribute - PITA with SimpleXML
+			preg_match('/xml:base="(.*)"/', $xml->asXML(), $matches);
+			if (is_array($matches) && sizeof($matches)>1) $this->base = $matches[1];
+								
+			return 	$xml->xpath("//*[contains(concat(' ',normalize-space(@class),' '),' $this->root_class ')]");
+			
+		}
+		
+		
+		private function loadURL($url)
+		{
+			$this->url	= $url;
+			
+			if ($this->tidy_mode == 'proxy' && $this->tidy_proxy != ''){
+				$url	= $this->tidy_proxy . $url;
+			}
+		
+			return @file_get_contents($url);
+			
+		}
+		
+		
+		private function postProcess($profile, $s)
+		{
+			$required	= $this->required;
+			
+			if (is_array($s) && array_key_exists($required[0], $s)){
+				$s	= array($s);
+			}
+			
+			$s	= $this->dedupeSingles($s);
+			
+			if (function_exists('hKit_'.$profile.'_post')){
+				$s		= call_user_func('hKit_'.$profile.'_post', $s);
+			}
+			
+			$s	= $this->removeTextVals($s);
+			
+			return $s;
+		}
+		
+		
+		private function resolvePath($filepath)
+		{	// ugly code ahoy: needs a serious tidy up
+					
+			$filepath	= $filepath[0];
+			
+			$base 	= $this->base;
+			$url	= $this->url;
+			
+			if ($base != '' &&  strpos($base, '://') !== false)
+				$url	= $base;
+			
+			$r		= parse_url($url);
+			$domain	= $r['scheme'] . '://' . $r['host'];
+
+			if (!isset($r['path'])) $r['path'] = '/';
+			$path	= explode('/', $r['path']);
+			$file	= explode('/', $filepath);
+			$new	= array('');
+
+			if (strpos($filepath, '://') !== false || strpos($filepath, 'data:') !== false){
+				return $filepath;
+			}
+
+			if ($file[0] == ''){
+				// absolute path
+				return ''.$domain . implode('/', $file);
+			}else{
+				// relative path
+				if ($path[sizeof($path)-1] == '') array_pop($path);
+				if (strpos($path[sizeof($path)-1], '.') !== false) array_pop($path);
+
+				foreach ($file as $segment){
+					if ($segment == '..'){
+						array_pop($path);
+					}else{
+						$new[]	= $segment;
+					}
+				}
+				return ''.$domain . implode('/', $path) . implode('/', $new);
+			}	
+		}
+		
+		private function resolveEmail($v)
+		{
+			$parts	= parse_url($v[0]);
+			return ($parts['path']);
+		}
+		
+		
+		private function dedupeSingles($s)
+		{
+			$singles	= $this->singles;
+			
+			foreach ($s as &$item){
+				foreach ($singles as $classname){
+					if (array_key_exists($classname, $item) && is_array($item[$classname])){
+						if (isset($item[$classname][0])) $item[$classname]	= $item[$classname][0];
+					}
+				}
+			}
+			
+			return $s;
+		}
+		
+		private function removeTextVals($s)
+		{
+			foreach ($s as $key => &$val){
+				if ($key){
+					$k = $key;
+				}else{
+					$k = '';
+				}
+				
+				if (is_array($val)){
+					$val = $this->removeTextVals($val);
+				}else{
+					if ($k == 'text'){
+						$val = '';
+					}
+				}
+			}
+			
+			return array_filter($s);
+		}
+
+	}
+
+
+?>
\ No newline at end of file
diff --git a/plugins/OStatus/lib/discovery.php b/plugins/OStatus/lib/discovery.php
new file mode 100644
index 000000000..f8449b309
--- /dev/null
+++ b/plugins/OStatus/lib/discovery.php
@@ -0,0 +1,310 @@
+<?php
+/**
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2010, StatusNet, Inc.
+ *
+ * A sample module to show best practices for StatusNet plugins
+ *
+ * PHP version 5
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @package   StatusNet
+ * @author    James Walker <james@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
+ * @link      http://status.net/
+ */
+
+/**
+ * This class implements LRDD-based service discovery based on the "Hammer Draft"
+ * (including webfinger)
+ *
+ * @see http://groups.google.com/group/webfinger/browse_thread/thread/9f3d93a479e91bbf
+ */
+class Discovery
+{
+
+    const LRDD_REL = 'lrdd';
+    const PROFILEPAGE = 'http://webfinger.net/rel/profile-page';
+    const UPDATESFROM = 'http://schemas.google.com/g/2010#updates-from';
+    const HCARD = 'http://microformats.org/profile/hcard';
+    
+    public $methods = array();
+
+    public function __construct()
+    {
+        $this->registerMethod('Discovery_LRDD_Host_Meta');
+        $this->registerMethod('Discovery_LRDD_Link_Header');
+        $this->registerMethod('Discovery_LRDD_Link_HTML');
+    }
+
+
+    public function registerMethod($class)
+    {
+        $this->methods[] = $class;
+    }
+    
+    /**
+     * Given a "user id" make sure it's normalized to either a webfinger
+     * acct: uri or a profile HTTP URL.
+     */
+    public static function normalize($user_id)
+    {
+        if (substr($user_id, 0, 5) == 'http:' ||
+            substr($user_id, 0, 6) == 'https:' ||
+            substr($user_id, 0, 5) == 'acct:') {
+            return $user_id;
+        }
+
+        if (strpos($user_id, '@') !== FALSE) {
+            return 'acct:' . $user_id;
+        }
+
+        return 'http://' . $user_id;
+    }
+
+    public static function isWebfinger($user_id)
+    {
+        $uri = Discovery::normalize($user_id);
+        
+        return (substr($uri, 0, 5) == 'acct:');
+    }
+
+    /**
+     * This implements the actual lookup procedure
+     */
+    public function lookup($id)
+    {
+        // Normalize the incoming $id to make sure we have a uri
+        $uri = $this->normalize($id);
+
+        foreach ($this->methods as $class) {
+            $links = call_user_func(array($class, 'discover'), $uri);
+            if ($link = Discovery::getService($links, Discovery::LRDD_REL)) {
+                // Load the LRDD XRD
+                if (!empty($link['template'])) {
+                    $xrd_uri = Discovery::applyTemplate($link['template'], $uri);
+                } else {
+                    $xrd_uri = $link['href'];
+                }
+                
+                $xrd = $this->fetchXrd($xrd_uri);
+                if ($xrd) {
+                    return $xrd;
+                }
+            }
+        }
+
+        throw new Exception('Unable to find services for '. $id);
+    }
+
+    public static function getService($links, $service) {
+        if (!is_array($links)) {
+            return false;
+        }
+        
+        foreach ($links as $link) {
+            if ($link['rel'] == $service) {
+                return $link;
+            }
+        }
+    }
+    
+
+    public static function applyTemplate($template, $id)
+    {
+        $template = str_replace('{uri}', urlencode($id), $template);
+
+        return $template;
+    }
+
+    
+    public static function fetchXrd($url)
+    {
+        try {
+            $client = new HTTPClient();
+            $response = $client->get($url);
+        } catch (HTTP_Request2_Exception $e) {
+            return false;
+        }
+
+        if ($response->getStatus() != 200) {
+            return false;
+        }
+
+        return XRD::parse($response->getBody());
+    }
+}
+
+interface Discovery_LRDD
+{
+    public function discover($uri);
+}
+
+class Discovery_LRDD_Host_Meta implements Discovery_LRDD
+{
+    public function discover($uri)
+    {
+        if (!Discovery::isWebfinger($uri)) {
+            return false;
+        }
+
+        // We have a webfinger acct: - start with host-meta
+        list($name, $domain) = explode('@', $uri);
+        $url = 'http://'. $domain .'/.well-known/host-meta';
+
+        $xrd = Discovery::fetchXrd($url);
+
+        if ($xrd) {
+            if ($xrd->host != $domain) {
+                return false;
+            }
+            
+            return $xrd->links;
+        }
+    }
+}
+
+class Discovery_LRDD_Link_Header implements Discovery_LRDD
+{
+    public function discover($uri)
+    {
+        try {
+            $client = new HTTPClient();
+            $response = $client->get($uri);
+        } catch (HTTP_Request2_Exception $e) {
+            return false;
+        }
+             
+        if ($response->getStatus() != 200) {
+            return false;
+        }
+
+        $link_header = $response->getHeader('Link');
+        if (!$link_header) {
+            //            return false;
+        }
+        
+        return Discovery_LRDD_Link_Header::parseHeader($link_header);
+    }
+
+    protected static function parseHeader($header)
+    {
+        preg_match('/^<[^>]+>/', $header, $uri_reference);
+        //if (empty($uri_reference)) return;
+
+        $links = array();
+        
+        $link_uri = trim($uri_reference[0], '<>');
+        $link_rel = array();
+        $link_type = null;
+        
+        // remove uri-reference from header
+        $header = substr($header, strlen($uri_reference[0]));
+        
+        // parse link-params
+        $params = explode(';', $header);
+        
+        foreach ($params as $param) {
+            if (empty($param)) continue;
+            list($param_name, $param_value) = explode('=', $param, 2);
+            $param_name = trim($param_name);
+            $param_value = preg_replace('(^"|"$)', '', trim($param_value));
+            
+            // for now we only care about 'rel' and 'type' link params
+            // TODO do something with the other links-params
+            switch ($param_name) {
+            case 'rel':
+                $link_rel = trim($param_value);
+                break;
+                
+            case 'type':
+                $link_type = trim($param_value);
+            }
+        }
+
+        $links[] =  array(
+            'href' => $link_uri,
+            'rel' => $link_rel,
+            'type' => $link_type);
+
+        return $links;
+    }
+}
+
+class Discovery_LRDD_Link_HTML implements Discovery_LRDD
+{
+    public function discover($uri)
+    {
+        try {
+            $client = new HTTPClient();
+            $response = $client->get($uri);
+        } catch (HTTP_Request2_Exception $e) {
+            return false;
+        }
+
+        if ($response->getStatus() != 200) {
+            return false;
+        }
+
+        return Discovery_LRDD_Link_HTML::parse($response->getBody());
+    }
+
+
+    public function parse($html)
+    {
+        $links = array();
+        
+        preg_match('/<head(\s[^>]*)?>(.*?)<\/head>/is', $html, $head_matches);
+        $head_html = $head_matches[2];
+        
+        preg_match_all('/<link\s[^>]*>/i', $head_html, $link_matches);
+        
+        foreach ($link_matches[0] as $link_html) {
+            $link_url = null;
+            $link_rel = null;
+            $link_type = null;
+            
+            preg_match('/\srel=(("|\')([^\\2]*?)\\2|[^"\'\s]+)/i', $link_html, $rel_matches);
+            if ( isset($rel_matches[3]) ) {
+                $link_rel = $rel_matches[3];
+            } else if ( isset($rel_matches[1]) ) {
+                $link_rel = $rel_matches[1];
+            }
+            
+            preg_match('/\shref=(("|\')([^\\2]*?)\\2|[^"\'\s]+)/i', $link_html, $href_matches);
+            if ( isset($href_matches[3]) ) {
+                $link_uri = $href_matches[3];
+            } else if ( isset($href_matches[1]) ) {
+                $link_uri = $href_matches[1];
+            }
+            
+            preg_match('/\stype=(("|\')([^\\2]*?)\\2|[^"\'\s]+)/i', $link_html, $type_matches);
+            if ( isset($type_matches[3]) ) {
+                $link_type = $type_matches[3];
+            } else if ( isset($type_matches[1]) ) {
+                $link_type = $type_matches[1];
+            }
+            
+            $links[] = array(
+                'href' => $link_url,
+                'rel' => $link_rel,
+                'type' => $link_type,
+            );
+        }
+        
+        return $links;
+    }
+}
diff --git a/plugins/OStatus/lib/magicenvelope.php b/plugins/OStatus/lib/magicenvelope.php
index 81f4609c5..fb8c57c71 100644
--- a/plugins/OStatus/lib/magicenvelope.php
+++ b/plugins/OStatus/lib/magicenvelope.php
@@ -50,19 +50,26 @@ class MagicEnvelope
 
     public function getKeyPair($signer_uri)
     {
-        return 'RSA.79_L2gq-TD72Nsb5yGS0r9stLLpJZF5AHXyxzWmQmlqKl276LEJEs8CppcerLcR90MbYQUwt-SX9slx40Yq3vA==.AQAB.AR-jo5KMfSISmDAT2iMs2_vNFgWRjl5rbJVvA0SpGIEWyPdCGxlPtCbTexp8-0ZEIe8a4SyjatBECH5hxgMTpw==';
-    }
-
-
-    public function signMessage($text, $mimetype, $signer_uri)
-    {
-        $signer_uri = $this->normalizeUser($signer_uri);
+        $disco = new Discovery();
 
-        if (!$this->checkAuthor($text, $signer_uri)) {
+        try {
+            $xrd = $disco->lookup($signer_uri);
+        } catch (Exception $e) {
             return false;
         }
+        if ($xrd->links) {
+            if ($link = Discovery::getService($xrd->links, Magicsig::PUBLICKEYREL)) {
+                list($type, $keypair) = explode(';', $link['href']);
+                return $keypair;
+            }
+        }
+        throw new Exception('Unable to locate signer public key');
+    }
+
 
-        $signature_alg = Magicsig::fromString($this->getKeyPair($signer_uri));
+    public function signMessage($text, $mimetype, $keypair)
+    {
+        $signature_alg = Magicsig::fromString($keypair);
         $armored_text = base64_encode($text);
 
         return array(
@@ -76,6 +83,28 @@ class MagicEnvelope
             
     }
 
+    public function toXML($env) {
+        $dom = new DOMDocument();
+
+        $envelope = $dom->createElementNS(MagicEnvelope::NS, 'me:env');
+        $envelope->setAttribute('xmlns:me', MagicEnvelope::NS);
+        $data = $dom->createElementNS(MagicEnvelope::NS, 'me:data', $env['data']);
+        $data->setAttribute('type', $env['data_type']);
+        $envelope->appendChild($data);
+        $enc = $dom->createElementNS(MagicEnvelope::NS, 'me:encoding', $env['encoding']);
+        $envelope->appendChild($enc);
+        $alg = $dom->createElementNS(MagicEnvelope::NS, 'me:alg', $env['alg']);
+        $envelope->appendChild($alg);
+        $sig = $dom->createElementNS(MagicEnvelope::NS, 'me:sig', $env['sig']);
+        $envelope->appendChild($sig);
+
+        $dom->appendChild($envelope);
+        
+        
+        return $dom->saveXML();
+    }
+
+    
     public function unfold($env)
     {
         $dom = new DOMDocument();
@@ -127,18 +156,32 @@ class MagicEnvelope
     public function verify($env)
     {
         if ($env['alg'] != 'RSA-SHA256') {
+            common_log(LOG_DEBUG, "Salmon error: bad algorithm");
             return false;
         }
 
         if ($env['encoding'] != MagicEnvelope::ENCODING) {
+            common_log(LOG_DEBUG, "Salmon error: bad encoding");
             return false;
         }
 
         $text = base64_decode($env['data']);
         $signer_uri = $this->getAuthor($text);
 
-        $verifier = Magicsig::fromString($this->getKeyPair($signer_uri));
+        try {
+            $keypair = $this->getKeyPair($signer_uri);
+        } catch (Exception $e) {
+            common_log(LOG_DEBUG, "Salmon error: ".$e->getMessage());
+            return false;
+        }
+        
+        $verifier = Magicsig::fromString($keypair);
 
+        if (!$verifier) {
+            common_log(LOG_DEBUG, "Salmon error: unable to parse keypair");
+            return false;
+        }
+        
         return $verifier->verify($env['data'], $env['sig']);
     }
 
diff --git a/plugins/OStatus/lib/ostatusqueuehandler.php b/plugins/OStatus/lib/ostatusqueuehandler.php
index 0da85600f..d1e58f1d6 100644
--- a/plugins/OStatus/lib/ostatusqueuehandler.php
+++ b/plugins/OStatus/lib/ostatusqueuehandler.php
@@ -87,7 +87,7 @@ class OStatusQueueHandler extends QueueHandler
             // remote user or group.
             // @fixme as an optimization we can skip this if the
             // remote profile is subscribed to the author.
-            $oprofile->notifyDeferred($this->notice);
+            $oprofile->notifyDeferred($this->notice, $this->user);
         }
     }
 
@@ -164,46 +164,21 @@ class OStatusQueueHandler extends QueueHandler
      */
     function userFeedForNotice()
     {
-        // @fixme this feels VERY hacky...
-        // should probably be a cleaner way to do it
-
-        ob_start();
-        $api = new ApiTimelineUserAction();
-        $api->prepare(array('id' => $this->notice->profile_id,
-                            'format' => 'atom',
-                            'max_id' => $this->notice->id,
-                            'since_id' => $this->notice->id - 1));
-        $api->showTimeline();
-        $feed = ob_get_clean();
-        
-        // ...and override the content-type back to something normal... eww!
-        // hope there's no other headers that got set while we weren't looking.
-        header('Content-Type: text/html; charset=utf-8');
-
-        common_log(LOG_DEBUG, $feed);
+        $atom = new AtomUserNoticeFeed($this->user);
+        $atom->addEntryFromNotice($this->notice);
+        $feed = $atom->getString();
+
         return $feed;
     }
 
     function groupFeedForNotice($group_id)
     {
-        // @fixme this feels VERY hacky...
-        // should probably be a cleaner way to do it
-
-        ob_start();
-        $api = new ApiTimelineGroupAction();
-        $args = array('id' => $group_id,
-                      'format' => 'atom',
-                      'max_id' => $this->notice->id,
-                      'since_id' => $this->notice->id - 1);
-        $api->prepare($args);
-        $api->handle($args);
-        $feed = ob_get_clean();
-        
-        // ...and override the content-type back to something normal... eww!
-        // hope there's no other headers that got set while we weren't looking.
-        header('Content-Type: text/html; charset=utf-8');
-
-        common_log(LOG_DEBUG, $feed);
+        $group = User_group::staticGet('id', $group_id);
+
+        $atom = new AtomGroupNoticeFeed($group);
+        $atom->addEntryFromNotice($this->notice);
+        $feed = $atom->getString();
+
         return $feed;
     }
 
diff --git a/plugins/OStatus/lib/pushinqueuehandler.php b/plugins/OStatus/lib/pushinqueuehandler.php
index a90f52df2..1fd29ae30 100644
--- a/plugins/OStatus/lib/pushinqueuehandler.php
+++ b/plugins/OStatus/lib/pushinqueuehandler.php
@@ -40,7 +40,11 @@ class PushInQueueHandler extends QueueHandler
 
         $feedsub = FeedSub::staticGet('id', $feedsub_id);
         if ($feedsub) {
-            $feedsub->receive($post, $hmac);
+            try {
+                $feedsub->receive($post, $hmac);
+            } catch(Exception $e) {
+                common_log(LOG_ERR, "Exception during PuSH input processing for $feedsub->uri: " . $e->getMessage());
+            }
         } else {
             common_log(LOG_ERR, "Discarding POST to unknown feed subscription id $feedsub_id");
         }
diff --git a/plugins/OStatus/lib/salmon.php b/plugins/OStatus/lib/salmon.php
index b5f178cc6..3d3341bc6 100644
--- a/plugins/OStatus/lib/salmon.php
+++ b/plugins/OStatus/lib/salmon.php
@@ -28,6 +28,11 @@
  */
 class Salmon
 {
+
+    const NS_REPLIES = "http://salmon-protocol.org/ns/salmon-replies";
+
+    const NS_MENTIONS = "http://salmon-protocol.org/ns/salmon-mention";
+    
     /**
      * Sign and post the given Atom entry as a Salmon message.
      *
@@ -37,17 +42,20 @@ class Salmon
      * @param string $xml
      * @return boolean success
      */
-    public function post($endpoint_uri, $xml)
+    public function post($endpoint_uri, $xml, $actor)
     {
         if (empty($endpoint_uri)) {
             return false;
         }
 
-        if (!common_config('ostatus', 'skip_signatures')) {
-            $xml = $this->createMagicEnv($xml);
+        try {
+            $xml = $this->createMagicEnv($xml, $actor);
+        } catch (Exception $e) {
+            common_log(LOG_ERR, "Salmon unable to sign: " . $e->getMessage());
+            return false;
         }
 
-        $headers = array('Content-Type: application/atom+xml');
+        $headers = array('Content-Type: application/magic-envelope+xml');
 
         try {
             $client = new HTTPClient();
@@ -65,24 +73,37 @@ class Salmon
         return true;
     }
 
-    public function createMagicEnv($text)
+    public function createMagicEnv($text, $actor)
     {
         $magic_env = new MagicEnvelope();
 
-        // TODO: Should probably be getting the signer uri as an argument?
-        $signer_uri = $magic_env->getAuthor($text);
-
-        $env = $magic_env->signMessage($text, 'application/atom+xml', $signer_uri);
+        $user = User::staticGet('id', $actor->id);
+        if ($user->id) {
+            // Use local key
+            $magickey = Magicsig::staticGet('user_id', $user->id);
+            if (!$magickey) {
+                // No keypair yet, let's generate one.
+                $magickey = new Magicsig();
+                $magickey->generate($user->id);
+            } 
+        } else {
+            throw new Exception("Salmon invalid actor for signing");
+        }
 
-        return $magic_env->unfold($env);
+        try {
+            $env = $magic_env->signMessage($text, 'application/atom+xml', $magickey->toString());
+        } catch (Exception $e) {
+            return $text;
+        }
+        return $magic_env->toXML($env);
     }
 
 
-    public function verifyMagicEnv($dom)
+    public function verifyMagicEnv($text)
     {
         $magic_env = new MagicEnvelope();
         
-        $env = $magic_env->fromDom($dom);
+        $env = $magic_env->parse($text);
 
         return $magic_env->verify($env);
     }
diff --git a/plugins/OStatus/lib/salmonaction.php b/plugins/OStatus/lib/salmonaction.php
index a03169101..fa9dc3b1d 100644
--- a/plugins/OStatus/lib/salmonaction.php
+++ b/plugins/OStatus/lib/salmonaction.php
@@ -41,29 +41,32 @@ class SalmonAction extends Action
             $this->clientError(_m('This method requires a POST.'));
         }
 
-        if (empty($_SERVER['CONTENT_TYPE']) || $_SERVER['CONTENT_TYPE'] != 'application/atom+xml') {
-            $this->clientError(_m('Salmon requires application/atom+xml'));
+        if (empty($_SERVER['CONTENT_TYPE']) || $_SERVER['CONTENT_TYPE'] != 'application/magic-envelope+xml') {
+            $this->clientError(_m('Salmon requires application/magic-envelope+xml'));
         }
 
         $xml = file_get_contents('php://input');
 
-        $dom = DOMDocument::loadXML($xml);
 
+        // Check the signature
+        $salmon = new Salmon;
+        if (!$salmon->verifyMagicEnv($xml)) {
+            common_log(LOG_DEBUG, "Salmon signature verification failed.");
+            $this->clientError(_m('Salmon signature verification failed.'));
+        } else {
+            $magic_env = new MagicEnvelope();
+            $env = $magic_env->parse($xml);
+            $xml = $magic_env->unfold($env);
+        }
+        
+
+        $dom = DOMDocument::loadXML($xml);
         if ($dom->documentElement->namespaceURI != Activity::ATOM ||
             $dom->documentElement->localName != 'entry') {
             common_log(LOG_DEBUG, "Got invalid Salmon post: $xml");
             $this->clientError(_m('Salmon post must be an Atom entry.'));
         }
 
-        // Check the signature
-        $salmon = new Salmon;
-        if (!common_config('ostatus', 'skip_signatures')) {
-            if (!$salmon->verifyMagicEnv($dom)) {
-                common_log(LOG_DEBUG, "Salmon signature verification failed.");
-                $this->clientError(_m('Salmon signature verification failed.'));
-            }
-        }
-
         $this->act = new Activity($dom->documentElement);
         return true;
     }
diff --git a/plugins/OStatus/lib/salmonqueuehandler.php b/plugins/OStatus/lib/salmonqueuehandler.php
index aa97018dc..7eeb5f8e9 100644
--- a/plugins/OStatus/lib/salmonqueuehandler.php
+++ b/plugins/OStatus/lib/salmonqueuehandler.php
@@ -35,8 +35,10 @@ class SalmonQueueHandler extends QueueHandler
         assert(is_string($data['salmonuri']));
         assert(is_string($data['entry']));
 
+        $actor = Profile::staticGet($data['actor']);
+        
         $salmon = new Salmon();
-        $salmon->post($data['salmonuri'], $data['entry']);
+        $salmon->post($data['salmonuri'], $data['entry'], $actor);
 
         // @fixme detect failure and attempt to resend
         return true;
diff --git a/plugins/OStatus/lib/webfinger.php b/plugins/OStatus/lib/webfinger.php
deleted file mode 100644
index 8a5037629..000000000
--- a/plugins/OStatus/lib/webfinger.php
+++ /dev/null
@@ -1,151 +0,0 @@
-<?php
-/**
- * StatusNet - the distributed open-source microblogging tool
- * Copyright (C) 2010, StatusNet, Inc.
- *
- * A sample module to show best practices for StatusNet plugins
- *
- * PHP version 5
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * @package   StatusNet
- * @author    James Walker <james@status.net>
- * @copyright 2010 StatusNet, Inc.
- * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
- * @link      http://status.net/
- */
-
-define('WEBFINGER_SERVICE_REL_VALUE', 'lrdd');
-
-/**
- * Implement the webfinger protocol.
- */
-
-class Webfinger
-{
-    const PROFILEPAGE = 'http://webfinger.net/rel/profile-page';
-    const UPDATESFROM = 'http://schemas.google.com/g/2010#updates-from';
-
-    /**
-     * Perform a webfinger lookup given an account.
-     */
-
-    public function lookup($id)
-    {
-        $id = $this->normalize($id);
-        list($name, $domain) = explode('@', $id);
-
-        $links = $this->getServiceLinks($domain);
-        if (!$links) {
-            return false;
-        }
-
-        $services = array();
-        foreach ($links as $link) {
-            if ($link['template']) {
-                return $this->getServiceDescription($link['template'], $id);
-            }
-            if ($link['href']) {
-                return $this->getServiceDescription($link['href'], $id);
-            }
-        }
-    }
-
-    /**
-     * Normalize an account ID
-     */
-    function normalize($id)
-    {
-        if (substr($id, 0, 7) == 'acct://') {
-            return substr($id, 7);
-        } else if (substr($id, 0, 5) == 'acct:') {
-            return substr($id, 5);
-        }
-
-        return $id;
-    }
-
-    function getServiceLinks($domain)
-    {
-        $url = 'http://'. $domain .'/.well-known/host-meta';
-        $content = $this->fetchURL($url);
-        if (empty($content)) {
-            common_log(LOG_DEBUG, 'Error fetching host-meta');
-            return false;
-        }
-        $result = XRD::parse($content);
-
-        // Ensure that the host == domain (spec may include signing later)
-        if ($result->host != $domain) {
-            return false;
-        }
-
-        $links = array();
-        foreach ($result->links as $link) {
-            if ($link['rel'] == WEBFINGER_SERVICE_REL_VALUE) {
-                $links[] = $link;
-            }
-
-        }
-        return $links;
-    }
-
-    function getServiceDescription($template, $id)
-    {
-        $url = $this->applyTemplate($template, 'acct:' . $id);
-
-        $content = $this->fetchURL($url);
-
-        if (!$content) {
-            return false;
-        }
-
-        return XRD::parse($content);
-    }
-
-    function fetchURL($url)
-    {
-        try {
-            $client = new HTTPClient();
-            $response = $client->get($url);
-        } catch (HTTP_Request2_Exception $e) {
-            return false;
-        }
-
-        if ($response->getStatus() != 200) {
-            return false;
-        }
-
-        return $response->getBody();
-    }
-
-    function applyTemplate($template, $id)
-    {
-        $template = str_replace('{uri}', urlencode($id), $template);
-
-        return $template;
-    }
-
-    function getHostMeta($domain, $template) {
-        $xrd = new XRD();
-        $xrd->host = $domain;
-        $xrd->links[] = array('rel' => 'lrdd',
-                              'template' => $template,
-                              'title' => array('Resource Descriptor'));
-
-        return $xrd->toXML();
-    }
-}
-
diff --git a/plugins/OStatus/lib/xrd.php b/plugins/OStatus/lib/xrd.php
index 16d27f8eb..aa13ef024 100644
--- a/plugins/OStatus/lib/xrd.php
+++ b/plugins/OStatus/lib/xrd.php
@@ -53,17 +53,25 @@ class XRD
         $xrd = new XRD();
 
         $dom = new DOMDocument();
-        $dom->loadXML($xml);
+        if (!$dom->loadXML($xml)) {
+            throw new Exception("Invalid XML");
+        }
         $xrd_element = $dom->getElementsByTagName('XRD')->item(0);
+        if (!$xrd_element) {
+            throw new Exception("Invalid XML, missing XRD root");
+        }
 
         // Check for host-meta host
-        $host = $xrd_element->getElementsByTagName('Host')->item(0)->nodeValue;
+        $host = $xrd_element->getElementsByTagName('Host')->item(0);
         if ($host) {
-            $xrd->host = $host;
+            $xrd->host = $host->nodeValue;
         }
 
         // Loop through other elements
         foreach ($xrd_element->childNodes as $node) {
+            if (!($node instanceof DOMElement)) {
+                continue;
+            }
             switch ($node->tagName) {
             case 'Expires':
                 $xrd->expires = $node->nodeValue;
@@ -144,9 +152,11 @@ class XRD
         $link['href'] = $element->getAttribute('href');
         $link['template'] = $element->getAttribute('template');
         foreach ($element->childNodes as $node) {
-            switch($node->tagName) {
-            case 'Title':
-                $link['title'][] = $node->nodeValue;
+            if ($node instanceof DOMElement) {
+                switch($node->tagName) {
+                case 'Title':
+                    $link['title'][] = $node->nodeValue;
+                }
             }
         }
 
@@ -156,20 +166,20 @@ class XRD
     function saveLink($doc, $link)
     {
         $link_element = $doc->createElement('Link');
-        if ($link['rel']) {
+        if (!empty($link['rel'])) {
             $link_element->setAttribute('rel', $link['rel']);
         }
-        if ($link['type']) {
+        if (!empty($link['type'])) {
             $link_element->setAttribute('type', $link['type']);
         }
-        if ($link['href']) {
+        if (!empty($link['href'])) {
             $link_element->setAttribute('href', $link['href']);
         }
-        if ($link['template']) {
+        if (!empty($link['template'])) {
             $link_element->setAttribute('template', $link['template']);
         }
 
-        if (is_array($link['title'])) {
+        if (!empty($link['title']) && is_array($link['title'])) {
             foreach($link['title'] as $title) {
                 $title = $doc->createElement('Title', $title);
                 $link_element->appendChild($title);
diff --git a/plugins/OStatus/actions/webfinger.php b/plugins/OStatus/lib/xrdaction.php
index 34336a903..6881292ad 100644
--- a/plugins/OStatus/actions/webfinger.php
+++ b/plugins/OStatus/lib/xrdaction.php
@@ -24,51 +24,43 @@
 
 if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
 
-class WebfingerAction extends Action
+class XrdAction extends Action
 {
 
     public $uri;
+    
+    public $user;
 
-    function prepare($args)
-    {
-        parent::prepare($args);
-
-        $this->uri = $this->trimmed('uri');
-
-        return true;
-    }
-
+    public $xrd;
+    
     function handle()
     {
-        $acct = Webfinger::normalize($this->uri);
-
-        $xrd = new XRD();
-
-        list($nick, $domain) = explode('@', urldecode($acct));
-        $nick = common_canonical_nickname($nick);
+        $nick =  $this->user->nickname;
 
-        $this->user = User::staticGet('nickname', $nick);
-        if (!$this->user) {
-            $this->clientError(_('No such user.'), 404);
-            return false;
+        if (empty($this->xrd)) {
+            $xrd = new XRD();
+        } else {
+            $xrd = $this->xrd;
         }
 
-        $xrd->subject = $this->uri;
+        if (empty($xrd->subject)) {
+            $xrd->subject = Discovery::normalize($this->uri);
+        }
         $xrd->alias[] = common_profile_url($nick);
-        $xrd->links[] = array('rel' => Webfinger::PROFILEPAGE,
+        $xrd->links[] = array('rel' => Discovery::PROFILEPAGE,
                               'type' => 'text/html',
                               'href' => common_profile_url($nick));
 
-        $xrd->links[] = array('rel' => Webfinger::UPDATESFROM,
+        $xrd->links[] = array('rel' => Discovery::UPDATESFROM,
                               'href' => common_local_url('ApiTimelineUser',
                                                          array('id' => $this->user->id,
                                                                'format' => 'atom')),
                               'type' => 'application/atom+xml');
 
         // hCard
-        $xrd->links[] = array('rel' => 'http://microformats.org/profile/hcard',
+        $xrd->links[] = array('rel' => Discovery::HCARD,
                               'type' => 'text/html',
-                              'href' => common_profile_url($nick));
+                              'href' => common_local_url('hcard', array('nickname' => $nick)));
 
         // XFN
         $xrd->links[] = array('rel' => 'http://gmpg.org/xfn/11',
@@ -78,12 +70,16 @@ class WebfingerAction extends Action
         $xrd->links[] = array('rel' => 'describedby',
                               'type' => 'application/rdf+xml',
                               'href' => common_local_url('foaf',
-                                                         array('nickname' => $nick)));                        
-        
-        $salmon_url = common_local_url('salmon',
+                                                         array('nickname' => $nick)));
+
+        // Salmon
+        $salmon_url = common_local_url('usersalmon',
                                        array('id' => $this->user->id));
 
-        $xrd->links[] = array('rel' => 'salmon',
+        $xrd->links[] = array('rel' => Salmon::NS_REPLIES,
+                              'href' => $salmon_url);
+
+        $xrd->links[] = array('rel' => Salmon::NS_MENTIONS,
                               'href' => $salmon_url);
 
         // Get this user's keypair
@@ -91,12 +87,12 @@ class WebfingerAction extends Action
         if (!$magickey) {
             // No keypair yet, let's generate one.
             $magickey = new Magicsig();
-            $magickey->generate();
+            $magickey->generate($this->user->id);
         }
-        
+
         $xrd->links[] = array('rel' => Magicsig::PUBLICKEYREL,
-                              'href' => 'data:application/magic-public-key;'. $magickey->keypair);
-        
+                              'href' => 'data:application/magic-public-key;'. $magickey->toString(false));
+
         // TODO - finalize where the redirect should go on the publisher
         $url = common_local_url('ostatussub') . '?profile={uri}';
         $xrd->links[] = array('rel' => 'http://ostatus.org/schema/1.0/subscribe',
diff --git a/plugins/OStatus/locale/OStatus.po b/plugins/OStatus/locale/OStatus.po
index dedc018e3..7e33a0eed 100644
--- a/plugins/OStatus/locale/OStatus.po
+++ b/plugins/OStatus/locale/OStatus.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2009-12-07 20:38-0800\n"
+"POT-Creation-Date: 2010-03-01 14:58-0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -16,89 +16,297 @@ msgstr ""
 "Content-Type: text/plain; charset=CHARSET\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: tests/gettext-speedtest.php:57 FeedSubPlugin.php:76
-msgid "Feeds"
+#: actions/groupsalmon.php:51
+msgid "Can't accept remote posts for a remote group."
+msgstr ""
+
+#: actions/groupsalmon.php:123
+msgid "Can't read profile to set up group membership."
 msgstr ""
 
-#: FeedSubPlugin.php:77
-msgid "Feed subscription options"
+#: actions/groupsalmon.php:126 actions/groupsalmon.php:169
+msgid "Groups can't join groups."
 msgstr ""
 
-#: feedmunger.php:215
+#: actions/groupsalmon.php:153
 #, php-format
-msgid "New post: \"%1$s\" %2$s"
+msgid "Could not join remote user %1$s to group %2$s."
 msgstr ""
 
-#: actions/feedsubsettings.php:41
-msgid "Feed subscriptions"
+#: actions/groupsalmon.php:166
+msgid "Can't read profile to cancel group membership."
 msgstr ""
 
-#: actions/feedsubsettings.php:52
-msgid ""
-"You can subscribe to feeds from other sites; updates will appear in your "
-"personal timeline."
+#: actions/groupsalmon.php:182
+#, php-format
+msgid "Could not remove remote user %1$s from group %2$s."
+msgstr ""
+
+#: actions/ostatusinit.php:40
+msgid "You can use the local subscription!"
+msgstr ""
+
+#: actions/ostatusinit.php:61
+msgid "There was a problem with your session token. Try again, please."
+msgstr ""
+
+#: actions/ostatusinit.php:79 actions/ostatussub.php:439
+msgid "Subscribe to user"
+msgstr ""
+
+#: actions/ostatusinit.php:97
+#, php-format
+msgid "Subscribe to %s"
 msgstr ""
 
-#: actions/feedsubsettings.php:96
+#: actions/ostatusinit.php:102
+msgid "User nickname"
+msgstr ""
+
+#: actions/ostatusinit.php:103
+msgid "Nickname of the user you want to follow"
+msgstr ""
+
+#: actions/ostatusinit.php:106
+msgid "Profile Account"
+msgstr ""
+
+#: actions/ostatusinit.php:107
+msgid "Your account id (i.e. user@identi.ca)"
+msgstr ""
+
+#: actions/ostatusinit.php:110 actions/ostatussub.php:115
+#: OStatusPlugin.php:205
 msgid "Subscribe"
 msgstr ""
 
-#: actions/feedsubsettings.php:98
+#: actions/ostatusinit.php:128
+msgid "Must provide a remote profile."
+msgstr ""
+
+#: actions/ostatusinit.php:138
+msgid "Couldn't look up OStatus account profile."
+msgstr ""
+
+#: actions/ostatusinit.php:153
+msgid "Couldn't confirm remote profile address."
+msgstr ""
+
+#: actions/ostatusinit.php:171
+msgid "OStatus Connect"
+msgstr ""
+
+#: actions/ostatussub.php:68
+msgid "Address or profile URL"
+msgstr ""
+
+#: actions/ostatussub.php:70
+msgid "Enter the profile URL of a PubSubHubbub-enabled feed"
+msgstr ""
+
+#: actions/ostatussub.php:74
 msgid "Continue"
 msgstr ""
 
-#: actions/feedsubsettings.php:151
-msgid "Empty feed URL!"
+#: actions/ostatussub.php:112 OStatusPlugin.php:503
+msgid "Join"
+msgstr ""
+
+#: actions/ostatussub.php:113
+msgid "Join this group"
+msgstr ""
+
+#: actions/ostatussub.php:116
+msgid "Subscribe to this user"
+msgstr ""
+
+#: actions/ostatussub.php:137
+msgid "You are already subscribed to this user."
+msgstr ""
+
+#: actions/ostatussub.php:165
+msgid "You are already a member of this group."
 msgstr ""
 
-#: actions/feedsubsettings.php:161
+#: actions/ostatussub.php:286
+msgid "Empty remote profile URL!"
+msgstr ""
+
+#: actions/ostatussub.php:297
+msgid "Invalid address format."
+msgstr ""
+
+#: actions/ostatussub.php:302
 msgid "Invalid URL or could not reach server."
 msgstr ""
 
-#: actions/feedsubsettings.php:164
+#: actions/ostatussub.php:304
 msgid "Cannot read feed; server returned error."
 msgstr ""
 
-#: actions/feedsubsettings.php:167
+#: actions/ostatussub.php:306
 msgid "Cannot read feed; server returned an empty page."
 msgstr ""
 
-#: actions/feedsubsettings.php:170
+#: actions/ostatussub.php:308
 msgid "Bad HTML, could not find feed link."
 msgstr ""
 
-#: actions/feedsubsettings.php:173
+#: actions/ostatussub.php:310
 msgid "Could not find a feed linked from this URL."
 msgstr ""
 
-#: actions/feedsubsettings.php:176
+#: actions/ostatussub.php:312
 msgid "Not a recognized feed type."
 msgstr ""
 
-#: actions/feedsubsettings.php:180
-msgid "Bad feed URL."
+#: actions/ostatussub.php:315
+#, php-format
+msgid "Bad feed URL: %s %s"
+msgstr ""
+
+#. TRANS: OStatus remote group subscription dialog error.
+#: actions/ostatussub.php:336
+msgid "Already a member!"
 msgstr ""
 
-#: actions/feedsubsettings.php:188
-msgid "Feed is not PuSH-enabled; cannot subscribe."
+#. TRANS: OStatus remote group subscription dialog error.
+#: actions/ostatussub.php:346
+msgid "Remote group join failed!"
 msgstr ""
 
-#: actions/feedsubsettings.php:208
-msgid "Feed subscription failed! Bad response from hub."
+#. TRANS: OStatus remote group subscription dialog error.
+#: actions/ostatussub.php:350
+msgid "Remote group join aborted!"
 msgstr ""
 
-#: actions/feedsubsettings.php:218
+#. TRANS: OStatus remote subscription dialog error.
+#: actions/ostatussub.php:356
 msgid "Already subscribed!"
 msgstr ""
 
-#: actions/feedsubsettings.php:220
-msgid "Feed subscribed!"
+#. TRANS: OStatus remote subscription dialog error.
+#: actions/ostatussub.php:361
+msgid "Remote subscription failed!"
 msgstr ""
 
-#: actions/feedsubsettings.php:222
-msgid "Feed subscription failed!"
+#. TRANS: Page title for OStatus remote subscription form
+#: actions/ostatussub.php:459
+msgid "Authorize subscription"
+msgstr ""
+
+#: actions/ostatussub.php:470
+msgid ""
+"You can subscribe to users from other supported sites. Paste their address "
+"or profile URI below:"
+msgstr ""
+
+#: classes/Ostatus_profile.php:789
+#, php-format
+msgid "Tried to update avatar for unsaved remote profile %s"
 msgstr ""
 
-#: actions/feedsubsettings.php:231
-msgid "Previewing feed:"
+#: classes/Ostatus_profile.php:797
+#, php-format
+msgid "Unable to fetch avatar from %s"
+msgstr ""
+
+#: lib/salmonaction.php:41
+msgid "This method requires a POST."
+msgstr ""
+
+#: lib/salmonaction.php:45
+msgid "Salmon requires application/magic-envelope+xml"
+msgstr ""
+
+#: lib/salmonaction.php:55
+msgid "Salmon signature verification failed."
+msgstr ""
+
+#: lib/salmonaction.php:67
+msgid "Salmon post must be an Atom entry."
+msgstr ""
+
+#: lib/salmonaction.php:115
+msgid "Unrecognized activity type."
+msgstr ""
+
+#: lib/salmonaction.php:123
+msgid "This target doesn't understand posts."
+msgstr ""
+
+#: lib/salmonaction.php:128
+msgid "This target doesn't understand follows."
+msgstr ""
+
+#: lib/salmonaction.php:133
+msgid "This target doesn't understand unfollows."
+msgstr ""
+
+#: lib/salmonaction.php:138
+msgid "This target doesn't understand favorites."
+msgstr ""
+
+#: lib/salmonaction.php:143
+msgid "This target doesn't understand unfavorites."
+msgstr ""
+
+#: lib/salmonaction.php:148
+msgid "This target doesn't understand share events."
+msgstr ""
+
+#: lib/salmonaction.php:153
+msgid "This target doesn't understand joins."
+msgstr ""
+
+#: lib/salmonaction.php:158
+msgid "This target doesn't understand leave events."
+msgstr ""
+
+#: OStatusPlugin.php:319
+#, php-format
+msgid "Sent from %s via OStatus"
+msgstr ""
+
+#: OStatusPlugin.php:371
+msgid "Could not set up remote subscription."
+msgstr ""
+
+#: OStatusPlugin.php:487
+msgid "Could not set up remote group membership."
+msgstr ""
+
+#: OStatusPlugin.php:504
+#, php-format
+msgid "%s has joined group %s."
+msgstr ""
+
+#: OStatusPlugin.php:512
+msgid "Failed joining remote group."
+msgstr ""
+
+#: OStatusPlugin.php:553
+msgid "Leave"
+msgstr ""
+
+#: OStatusPlugin.php:554
+#, php-format
+msgid "%s has left group %s."
+msgstr ""
+
+#: OStatusPlugin.php:685
+msgid "Subscribe to remote user"
+msgstr ""
+
+#: OStatusPlugin.php:726
+msgid "Profile update"
+msgstr ""
+
+#: OStatusPlugin.php:727
+#, php-format
+msgid "%s has updated their profile page."
+msgstr ""
+
+#: tests/gettext-speedtest.php:57
+msgid "Feeds"
 msgstr ""
diff --git a/plugins/OStatus/scripts/updateostatus.php b/plugins/OStatus/scripts/updateostatus.php
new file mode 100644
index 000000000..d553a7d62
--- /dev/null
+++ b/plugins/OStatus/scripts/updateostatus.php
@@ -0,0 +1,127 @@
+#!/usr/bin/env php
+<?php
+/*
+ * StatusNet - a distributed open-source microblogging tool
+ * Copyright (C) 2008, 2009, StatusNet, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+define('INSTALLDIR', realpath(dirname(__FILE__) . '/../../..'));
+
+$shortoptions = 'i:n:a';
+$longoptions = array('id=', 'nickname=', 'all');
+
+$helptext = <<<END_OF_UPDATEOSTATUS_HELP
+updateostatus.php [options]
+update the OMB subscriptions of a user to use OStatus if possible
+
+  -i --id       ID of user to update
+  -n --nickname nickname of the user to update
+  -a --all      update all
+
+END_OF_UPDATEOSTATUS_HELP;
+
+require_once INSTALLDIR.'/scripts/commandline.inc';
+
+try {
+    $user = null;
+
+    if (have_option('i', 'id')) {
+        $id = get_option_value('i', 'id');
+        $user = User::staticGet('id', $id);
+        if (empty($user)) {
+            throw new Exception("Can't find user with id '$id'.");
+        }
+        updateProfileURL($user);
+    } else if (have_option('n', 'nickname')) {
+        $nickname = get_option_value('n', 'nickname');
+        $user = User::staticGet('nickname', $nickname);
+        if (empty($user)) {
+            throw new Exception("Can't find user with nickname '$nickname'");
+        }
+        updateProfileURL($user);
+    } else if (have_option('a', 'all')) {
+        $user = new User();
+        if ($user->find()) {
+            while ($user->fetch()) {
+                updateOStatus($user);
+            }
+        }
+    } else {
+        show_help();
+        exit(1);
+    }
+} catch (Exception $e) {
+    print $e->getMessage()."\n";
+    exit(1);
+}
+
+function updateOStatus($user)
+{
+    if (!have_option('q', 'quiet')) {
+        echo "{$user->nickname}...";
+    }
+
+    $up = $user->getProfile();
+
+    $sp = $user->getSubscriptions();
+
+    $rps = array();
+
+    while ($sp->fetch()) {
+        $remote = Remote_profile::staticGet('id', $sp->id);
+
+        if (!empty($remote)) {
+            $rps[] = clone($sp);
+        }
+    }
+
+    if (!have_option('q', 'quiet')) {
+        echo count($rps) . "\n";
+    }
+
+    foreach ($rps as $rp) {
+        try {
+            if (!have_option('q', 'quiet')) {
+                echo "Checking {$rp->nickname}...";
+            }
+
+            $op = Ostatus_profile::ensureProfile($rp->profileurl);
+
+            if (empty($op)) {
+                echo "can't convert.\n";
+                continue;
+            } else {
+                if (!have_option('q', 'quiet')) {
+                    echo "Converting...";
+                }
+                Subscription::cancel($up, $rp);
+                Subscription::start($up, $op->localProfile());
+                if (!have_option('q', 'quiet')) {
+                    echo "done.\n";
+                }
+            }
+
+        } catch (Exception $e) {
+            if (!have_option('q', 'quiet')) {
+                echo "fail.\n";
+            }
+            continue;
+            common_log(LOG_WARNING, "Couldn't convert OMB subscription (" . $up->nickname . ", " . $rp->nickname .
+                       ") to OStatus: " . $e->getMessage());
+            continue;
+        }
+    }
+}
diff --git a/plugins/OStatus/theme/base/css/ostatus.css b/plugins/OStatus/theme/base/css/ostatus.css
index feeeb47d3..c2d724158 100644
--- a/plugins/OStatus/theme/base/css/ostatus.css
+++ b/plugins/OStatus/theme/base/css/ostatus.css
@@ -38,11 +38,37 @@ display:none;
 min-width:96px;
 }
 
-#subscriptions #entity_remote_subscribe {
+#entity_remote_subscribe {
 padding:0;
 float:right;
+position:relative;
 }
 
-#subscriptions .entity_remote_subscribe {
-float:right;
+.section .entity_actions {
+margin-bottom:0;
+margin-right:7px;
+}
+
+#entity_remote_subscribe .dialogbox {
+width:405px;
+}
+
+.aside #entity_subscriptions .more,
+.aside #entity_groups .more {
+float:left;
+}
+
+.section #entity_remote_subscribe {
+border:0;
+}
+
+.section .entity_remote_subscribe {
+color:#002FA7;
+box-shadow:none;
+-moz-box-shadow:none;
+-webkit-box-shadow:none;
+background-color:transparent;
+background-position:0 -1183px;
+padding:0 0 0 23px;
+border:0;
 }
diff --git a/plugins/OpenID/User_openid.php b/plugins/OpenID/User_openid.php
index 801b49ecc..5ef05b4c7 100644
--- a/plugins/OpenID/User_openid.php
+++ b/plugins/OpenID/User_openid.php
@@ -39,9 +39,21 @@ class User_openid extends Memcached_DataObject
                      );
     }
 
+    /**
+     * List primary and unique keys in this table.
+     * Unique keys used for lookup *MUST* be listed to ensure proper caching.
+     */
     function keys()
     {
-        return array('canonical' => 'K', 'display' => 'U');
+        return array('canonical' => 'K', 'display' => 'U', 'user_id' => 'U');
+    }
+
+    /**
+     * No sequence keys in this table.
+     */
+    function sequenceKey()
+    {
+        return array(false, false, false);
     }
 
     Static function hasOpenID($user_id)
diff --git a/plugins/OpenID/locale/OpenID.po b/plugins/OpenID/locale/OpenID.po
index 34738bc75..7ed879835 100644
--- a/plugins/OpenID/locale/OpenID.po
+++ b/plugins/OpenID/locale/OpenID.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2009-12-07 20:38-0800\n"
+"POT-Creation-Date: 2010-03-01 14:58-0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -16,73 +16,152 @@ msgstr ""
 "Content-Type: text/plain; charset=CHARSET\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: openidlogin.php:30 finishopenidlogin.php:34
+#: finishaddopenid.php:67
+msgid "Not logged in."
+msgstr ""
+
+#: finishaddopenid.php:88 finishopenidlogin.php:149
+msgid "OpenID authentication cancelled."
+msgstr ""
+
+#: finishaddopenid.php:92 finishopenidlogin.php:153
+#, php-format
+msgid "OpenID authentication failed: %s"
+msgstr ""
+
+#: finishaddopenid.php:112
+msgid "You already have this OpenID!"
+msgstr ""
+
+#: finishaddopenid.php:114
+msgid "Someone else already has this OpenID."
+msgstr ""
+
+#: finishaddopenid.php:126
+msgid "Error connecting user."
+msgstr ""
+
+#: finishaddopenid.php:131
+msgid "Error updating profile"
+msgstr ""
+
+#: finishaddopenid.php:170 openidlogin.php:95
+msgid "OpenID Login"
+msgstr ""
+
+#: finishopenidlogin.php:34 openidlogin.php:30
 msgid "Already logged in."
 msgstr ""
 
-#: openidlogin.php:37 openidsettings.php:194 finishopenidlogin.php:38
+#: finishopenidlogin.php:38 openidlogin.php:37 openidsettings.php:194
 msgid "There was a problem with your session token. Try again, please."
 msgstr ""
 
-#: openidlogin.php:66
+#: finishopenidlogin.php:43
+msgid "You can't register if you don't agree to the license."
+msgstr ""
+
+#: finishopenidlogin.php:52 openidsettings.php:208
+msgid "Something weird happened."
+msgstr ""
+
+#: finishopenidlogin.php:66
 #, php-format
 msgid ""
-"For security reasons, please re-login with your [OpenID](%%doc.openid%%) "
-"before changing your settings."
+"This is the first time you've logged into %s so we must connect your OpenID "
+"to a local account. You can either create a new account, or connect with "
+"your existing account, if you have one."
 msgstr ""
 
-#: openidlogin.php:70
-#, php-format
-msgid "Login with an [OpenID](%%doc.openid%%) account."
+#: finishopenidlogin.php:72
+msgid "OpenID Account Setup"
 msgstr ""
 
-#: openidlogin.php:95 finishaddopenid.php:170
-msgid "OpenID Login"
+#: finishopenidlogin.php:97
+msgid "Create new account"
 msgstr ""
 
-#: openidlogin.php:112
-msgid "OpenID login"
+#: finishopenidlogin.php:99
+msgid "Create a new user with this nickname."
 msgstr ""
 
-#: openidlogin.php:117 openidsettings.php:107
-msgid "OpenID URL"
+#: finishopenidlogin.php:102
+msgid "New nickname"
 msgstr ""
 
-#: openidlogin.php:119
-msgid "Your OpenID URL"
+#: finishopenidlogin.php:104
+msgid "1-64 lowercase letters or numbers, no punctuation or spaces"
 msgstr ""
 
-#: openidlogin.php:122
-msgid "Remember me"
+#: finishopenidlogin.php:114
+msgid "My text and files are available under "
 msgstr ""
 
-#: openidlogin.php:123
-msgid "Automatically login in the future; not for shared computers!"
+#: finishopenidlogin.php:117
+msgid ""
+" except this private data: password, email address, IM address, phone number."
 msgstr ""
 
-#: openidlogin.php:127
-msgid "Login"
+#: finishopenidlogin.php:121
+msgid "Create"
 msgstr ""
 
-#: openidserver.php:106
-#, php-format
-msgid "You are not authorized to use the identity %s"
+#: finishopenidlogin.php:126
+msgid "Connect existing account"
 msgstr ""
 
-#: openidserver.php:126
-msgid "Just an OpenID provider. Nothing to see here, move along..."
+#: finishopenidlogin.php:128
+msgid ""
+"If you already have an account, login with your username and password to "
+"connect it to your OpenID."
 msgstr ""
 
-#: OpenIDPlugin.php:123 OpenIDPlugin.php:135
-msgid "OpenID"
+#: finishopenidlogin.php:131
+msgid "Existing nickname"
 msgstr ""
 
-#: OpenIDPlugin.php:124
-msgid "Login or register with OpenID"
+#: finishopenidlogin.php:134
+msgid "Password"
 msgstr ""
 
-#: OpenIDPlugin.php:136
-msgid "Add or remove OpenIDs"
+#: finishopenidlogin.php:137
+msgid "Connect"
+msgstr ""
+
+#: finishopenidlogin.php:215 finishopenidlogin.php:224
+msgid "Registration not allowed."
+msgstr ""
+
+#: finishopenidlogin.php:231
+msgid "Not a valid invitation code."
+msgstr ""
+
+#: finishopenidlogin.php:241
+msgid "Nickname must have only lowercase letters and numbers and no spaces."
+msgstr ""
+
+#: finishopenidlogin.php:246
+msgid "Nickname not allowed."
+msgstr ""
+
+#: finishopenidlogin.php:251
+msgid "Nickname already in use. Try another one."
+msgstr ""
+
+#: finishopenidlogin.php:258 finishopenidlogin.php:338
+msgid "Stored OpenID not found."
+msgstr ""
+
+#: finishopenidlogin.php:267
+msgid "Creating new account for OpenID that already has a user."
+msgstr ""
+
+#: finishopenidlogin.php:327
+msgid "Invalid username or password."
+msgstr ""
+
+#: finishopenidlogin.php:345
+msgid "Error connecting user to OpenID."
 msgstr ""
 
 #: openid.php:141
@@ -126,57 +205,65 @@ msgstr ""
 msgid "OpenID Auto-Submit"
 msgstr ""
 
-#: openidtrust.php:51
-msgid "OpenID Identity Verification"
-msgstr ""
-
-#: openidtrust.php:69
+#: openidlogin.php:66
+#, php-format
 msgid ""
-"This page should only be reached during OpenID processing, not directly."
+"For security reasons, please re-login with your [OpenID](%%doc.openid%%) "
+"before changing your settings."
 msgstr ""
 
-#: openidtrust.php:118
+#: openidlogin.php:70
 #, php-format
-msgid ""
-"%s  has asked to verify your identity. Click Continue to verify your "
-"identity and login without creating a new password."
+msgid "Login with an [OpenID](%%doc.openid%%) account."
 msgstr ""
 
-#: openidtrust.php:136
-msgid "Continue"
+#: openidlogin.php:112
+msgid "OpenID login"
 msgstr ""
 
-#: openidtrust.php:137
-msgid "Cancel"
+#: openidlogin.php:117 openidsettings.php:107
+msgid "OpenID URL"
 msgstr ""
 
-#: finishaddopenid.php:67
-msgid "Not logged in."
+#: openidlogin.php:119
+msgid "Your OpenID URL"
 msgstr ""
 
-#: finishaddopenid.php:88 finishopenidlogin.php:149
-msgid "OpenID authentication cancelled."
+#: openidlogin.php:122
+msgid "Remember me"
 msgstr ""
 
-#: finishaddopenid.php:92 finishopenidlogin.php:153
-#, php-format
-msgid "OpenID authentication failed: %s"
+#: openidlogin.php:123
+msgid "Automatically login in the future; not for shared computers!"
 msgstr ""
 
-#: finishaddopenid.php:112
-msgid "You already have this OpenID!"
+#: openidlogin.php:127
+msgid "Login"
 msgstr ""
 
-#: finishaddopenid.php:114
-msgid "Someone else already has this OpenID."
+#: OpenIDPlugin.php:123 OpenIDPlugin.php:135
+msgid "OpenID"
 msgstr ""
 
-#: finishaddopenid.php:126
-msgid "Error connecting user."
+#: OpenIDPlugin.php:124
+msgid "Login or register with OpenID"
 msgstr ""
 
-#: finishaddopenid.php:131
-msgid "Error updating profile"
+#: OpenIDPlugin.php:136
+msgid "Add or remove OpenIDs"
+msgstr ""
+
+#: OpenIDPlugin.php:324
+msgid "Use <a href=\"http://openid.net/\">OpenID</a> to login to the site."
+msgstr ""
+
+#: openidserver.php:106
+#, php-format
+msgid "You are not authorized to use the identity %s."
+msgstr ""
+
+#: openidserver.php:126
+msgid "Just an OpenID provider. Nothing to see here, move along..."
 msgstr ""
 
 #: openidsettings.php:59
@@ -224,10 +311,6 @@ msgstr ""
 msgid "Remove"
 msgstr ""
 
-#: openidsettings.php:208 finishopenidlogin.php:52
-msgid "Something weird happened."
-msgstr ""
-
 #: openidsettings.php:228
 msgid "No such OpenID."
 msgstr ""
@@ -240,105 +323,26 @@ msgstr ""
 msgid "OpenID removed."
 msgstr ""
 
-#: finishopenidlogin.php:43
-msgid "You can't register if you don't agree to the license."
-msgstr ""
-
-#: finishopenidlogin.php:66
-#, php-format
-msgid ""
-"This is the first time you've logged into %s so we must connect your OpenID "
-"to a local account. You can either create a new account, or connect with "
-"your existing account, if you have one."
-msgstr ""
-
-#: finishopenidlogin.php:72
-msgid "OpenID Account Setup"
-msgstr ""
-
-#: finishopenidlogin.php:97
-msgid "Create new account"
-msgstr ""
-
-#: finishopenidlogin.php:99
-msgid "Create a new user with this nickname."
-msgstr ""
-
-#: finishopenidlogin.php:102
-msgid "New nickname"
-msgstr ""
-
-#: finishopenidlogin.php:104
-msgid "1-64 lowercase letters or numbers, no punctuation or spaces"
-msgstr ""
-
-#: finishopenidlogin.php:114
-msgid "My text and files are available under "
+#: openidtrust.php:51
+msgid "OpenID Identity Verification"
 msgstr ""
 
-#: finishopenidlogin.php:117
+#: openidtrust.php:69
 msgid ""
-" except this private data: password, email address, IM address, phone number."
-msgstr ""
-
-#: finishopenidlogin.php:121
-msgid "Create"
-msgstr ""
-
-#: finishopenidlogin.php:126
-msgid "Connect existing account"
+"This page should only be reached during OpenID processing, not directly."
 msgstr ""
 
-#: finishopenidlogin.php:128
+#: openidtrust.php:118
+#, php-format
 msgid ""
-"If you already have an account, login with your username and password to "
-"connect it to your OpenID."
-msgstr ""
-
-#: finishopenidlogin.php:131
-msgid "Existing nickname"
-msgstr ""
-
-#: finishopenidlogin.php:134
-msgid "Password"
-msgstr ""
-
-#: finishopenidlogin.php:137
-msgid "Connect"
-msgstr ""
-
-#: finishopenidlogin.php:215 finishopenidlogin.php:224
-msgid "Registration not allowed."
-msgstr ""
-
-#: finishopenidlogin.php:231
-msgid "Not a valid invitation code."
-msgstr ""
-
-#: finishopenidlogin.php:241
-msgid "Nickname must have only lowercase letters and numbers and no spaces."
-msgstr ""
-
-#: finishopenidlogin.php:246
-msgid "Nickname not allowed."
-msgstr ""
-
-#: finishopenidlogin.php:251
-msgid "Nickname already in use. Try another one."
-msgstr ""
-
-#: finishopenidlogin.php:258 finishopenidlogin.php:338
-msgid "Stored OpenID not found."
-msgstr ""
-
-#: finishopenidlogin.php:267
-msgid "Creating new account for OpenID that already has a user."
+"%s  has asked to verify your identity. Click Continue to verify your "
+"identity and login without creating a new password."
 msgstr ""
 
-#: finishopenidlogin.php:327
-msgid "Invalid username or password."
+#: openidtrust.php:136
+msgid "Continue"
 msgstr ""
 
-#: finishopenidlogin.php:345
-msgid "Error connecting user to OpenID."
+#: openidtrust.php:137
+msgid "Cancel"
 msgstr ""
diff --git a/plugins/PoweredByStatusNet/locale/PoweredByStatusNet.po b/plugins/PoweredByStatusNet/locale/PoweredByStatusNet.po
index bd39124ef..8f8434a85 100644
--- a/plugins/PoweredByStatusNet/locale/PoweredByStatusNet.po
+++ b/plugins/PoweredByStatusNet/locale/PoweredByStatusNet.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2010-01-22 15:03-0800\n"
+"POT-Creation-Date: 2010-03-01 14:58-0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -16,16 +16,16 @@ msgstr ""
 "Content-Type: text/plain; charset=CHARSET\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: PoweredByStatusNetPlugin.php:49
+#: PoweredByStatusNetPlugin.php:50
 #, php-format
 msgid "powered by %s"
 msgstr ""
 
-#: PoweredByStatusNetPlugin.php:51
+#: PoweredByStatusNetPlugin.php:52
 msgid "StatusNet"
 msgstr ""
 
-#: PoweredByStatusNetPlugin.php:64
+#: PoweredByStatusNetPlugin.php:65
 msgid ""
 "Outputs powered by <a href=\"http://status.net/\">StatusNet</a> after site "
 "name."
diff --git a/plugins/PubSubHubBub/PubSubHubBubPlugin.php b/plugins/PubSubHubBub/PubSubHubBubPlugin.php
deleted file mode 100644
index a880dc866..000000000
--- a/plugins/PubSubHubBub/PubSubHubBubPlugin.php
+++ /dev/null
@@ -1,285 +0,0 @@
-<?php
-/**
- * StatusNet, the distributed open-source microblogging tool
- *
- * Plugin to push RSS/Atom updates to a PubSubHubBub hub
- *
- * PHP version 5
- *
- * LICENCE: This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * @category  Plugin
- * @package   StatusNet
- * @author    Craig Andrews <candrews@integralblue.com>
- * @copyright 2009 Craig Andrews http://candrews.integralblue.com
- * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
- * @link      http://status.net/
- */
-
-if (!defined('STATUSNET')) {
-    exit(1);
-}
-
-define('DEFAULT_HUB', 'http://pubsubhubbub.appspot.com');
-
-require_once INSTALLDIR.'/plugins/PubSubHubBub/publisher.php';
-
-/**
- * Plugin to provide publisher side of PubSubHubBub (PuSH)
- * relationship.
- *
- * PuSH is a real-time or near-real-time protocol for Atom
- * and RSS feeds. More information here:
- *
- * http://code.google.com/p/pubsubhubbub/
- *
- * To enable, add the following line to your config.php:
- *
- * addPlugin('PubSubHubBub');
- *
- * This will use the Google default hub. If you'd like to use
- * another, try:
- *
- * addPlugin('PubSubHubBub',
- *           array('hub' => 'http://yourhub.example.net/'));
- *
- * @category  Plugin
- * @package   StatusNet
- * @author    Craig Andrews <candrews@integralblue.com>
- * @copyright 2009 Craig Andrews http://candrews.integralblue.com
- * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPLv3
- * @link      http://status.net/
- */
-
-class PubSubHubBubPlugin extends Plugin
-{
-    /**
-     * URL of the hub to advertise and publish to.
-     */
-
-    public $hub = DEFAULT_HUB;
-
-    /**
-     * Default constructor.
-     */
-
-    function __construct()
-    {
-        parent::__construct();
-    }
-
-    /**
-     * Check if plugin should be active; may be mass-enabled.
-     * @return boolean
-     */
-
-    function enabled()
-    {
-        if (common_config('site', 'private')) {
-            // PuSH relies on public feeds
-            return false;
-        }
-        // @fixme check for being on a private network?
-        return true;
-    }
-
-    /**
-     * Hooks the StartApiAtom event
-     *
-     * Adds the necessary bits to advertise PubSubHubBub
-     * for the Atom feed.
-     *
-     * @param Action $action The API action being shown.
-     *
-     * @return boolean hook value
-     */
-
-    function onStartApiAtom($action)
-    {
-        if ($this->enabled()) {
-            $action->element('link', array('rel' => 'hub', 'href' => $this->hub), null);
-        }
-        return true;
-    }
-
-    /**
-     * Hooks the StartApiRss event
-     *
-     * Adds the necessary bits to advertise PubSubHubBub
-     * for the RSS 2.0 feeds.
-     *
-     * @param Action $action The API action being shown.
-     *
-     * @return boolean hook value
-     */
-
-    function onStartApiRss($action)
-    {
-        if ($this->enabled()) {
-            $action->element('atom:link', array('rel' => 'hub',
-                                                'href' => $this->hub),
-                             null);
-        }
-        return true;
-    }
-
-    /**
-     * Hook for a queued notice.
-     *
-     * When a notice has been queued, will ping the
-     * PuSH hub for each Atom and RSS feed in which
-     * the notice appears.
-     *
-     * @param Notice $notice The notice that's been queued
-     *
-     * @return boolean hook value
-     */
-
-    function onHandleQueuedNotice($notice)
-    {
-        if (!$this->enabled()) {
-            return false;
-        }
-        $publisher = new Publisher($this->hub);
-
-        $feeds = array();
-
-        //public timeline feeds
-        $feeds[] = common_local_url('ApiTimelinePublic', array('format' => 'rss'));
-        $feeds[] = common_local_url('ApiTimelinePublic', array('format' => 'atom'));
-
-        //author's own feeds
-        $user = User::staticGet('id', $notice->profile_id);
-
-        $feeds[] = common_local_url('ApiTimelineUser',
-                                    array('id' => $user->nickname,
-                                          'format' => 'rss'));
-        $feeds[] = common_local_url('ApiTimelineUser',
-                                    array('id' => $user->nickname,
-                                          'format' => 'atom'));
-
-        //tag feeds
-        $tag = new Notice_tag();
-
-        $tag->notice_id = $notice->id;
-        if ($tag->find()) {
-            while ($tag->fetch()) {
-                $feeds[] = common_local_url('ApiTimelineTag',
-                                            array('tag' => $tag->tag,
-                                                  'format' => 'rss'));
-                $feeds[] = common_local_url('ApiTimelineTag',
-                                            array('tag' => $tag->tag,
-                                                  'format' => 'atom'));
-            }
-        }
-
-        //group feeds
-        $group_inbox = new Group_inbox();
-
-        $group_inbox->notice_id = $notice->id;
-        if ($group_inbox->find()) {
-            while ($group_inbox->fetch()) {
-                $group = User_group::staticGet('id', $group_inbox->group_id);
-
-                $feeds[] = common_local_url('ApiTimelineGroup',
-                                            array('id' => $group->nickname,
-                                                  'format' => 'rss'));
-                $feeds[] = common_local_url('ApiTimelineGroup',
-                                            array('id' => $group->nickname,
-                                                  'format' => 'atom'));
-            }
-        }
-
-        //feed of each user that subscribes to the notice's author
-
-        $ni = $notice->whoGets();
-
-        foreach (array_keys($ni) as $user_id) {
-            $user = User::staticGet('id', $user_id);
-            if (empty($user)) {
-                continue;
-            }
-            $feeds[] = common_local_url('ApiTimelineFriends',
-                                        array('id' => $user->nickname,
-                                              'format' => 'rss'));
-            $feeds[] = common_local_url('ApiTimelineFriends',
-                                        array('id' => $user->nickname,
-                                              'format' => 'atom'));
-        }
-
-        $replies = $notice->getReplies();
-
-        //feed of user replied to
-        foreach ($replies as $recipient) {
-                $user = User::staticGet('id', $recipient);
-            if (!empty($user)) {
-                $feeds[] = common_local_url('ApiTimelineMentions',
-                                            array('id' => $user->nickname,
-                                                  'format' => 'rss'));
-                $feeds[] = common_local_url('ApiTimelineMentions',
-                                            array('id' => $user->nickname,
-                                                  'format' => 'atom'));
-            }
-        }
-        $feeds = array_unique($feeds);
-
-        ob_start();
-        $ok = $publisher->publish_update($feeds);
-        $push_last_response = ob_get_clean();
-
-        if (!$ok) {
-            common_log(LOG_WARNING,
-                       'Failure publishing ' . count($feeds) . ' feeds to hub at '.
-                       $this->hub.': '.$push_last_response);
-        } else {
-            common_log(LOG_INFO,
-                       'Published ' . count($feeds) . ' feeds to hub at '.
-                       $this->hub.': '.$push_last_response);
-        }
-
-        return true;
-    }
-
-    /**
-     * Provide version information
-     *
-     * Adds this plugin's version data to the global
-     * version array, for e.g. displaying on the version page.
-     *
-     * @param array &$versions array of array of versions
-     *
-     * @return boolean hook value
-     */
-
-    function onPluginVersion(&$versions)
-    {
-        $about = _m('The PubSubHubBub plugin pushes RSS/Atom updates '.
-                    'to a <a href = "'.
-                    'http://pubsubhubbub.googlecode.com/'.
-                    '">PubSubHubBub</a> hub.');
-        if (!$this->enabled()) {
-            $about = '<span class="disabled" style="color:gray">' . $about . '</span> ' .
-                     _m('(inactive on private site)');
-        }
-        $versions[] = array('name' => 'PubSubHubBub',
-                            'version' => STATUSNET_VERSION,
-                            'author' => 'Craig Andrews',
-                            'homepage' =>
-                            'http://status.net/wiki/Plugin:PubSubHubBub',
-                            'rawdescription' =>
-                            $about);
-
-        return true;
-    }
-}
diff --git a/plugins/PubSubHubBub/publisher.php b/plugins/PubSubHubBub/publisher.php
deleted file mode 100644
index f176a9b8a..000000000
--- a/plugins/PubSubHubBub/publisher.php
+++ /dev/null
@@ -1,86 +0,0 @@
-<?php
-
-// a PHP client library for pubsubhubbub
-// as defined at http://code.google.com/p/pubsubhubbub/
-// written by Josh Fraser | joshfraser.com | josh@eventvue.com
-// Released under Apache License 2.0
-
-class Publisher {
-    
-    protected $hub_url;
-    protected $last_response;
-    
-    // create a new Publisher
-    public function __construct($hub_url) {
-        
-        if (!isset($hub_url))
-            throw new Exception('Please specify a hub url');
-        
-        if (!preg_match("|^https?://|i",$hub_url)) 
-            throw new Exception('The specified hub url does not appear to be valid: '.$hub_url);
-            
-        $this->hub_url = $hub_url;
-    }
-
-    // accepts either a single url or an array of urls
-    public function publish_update($topic_urls, $http_function = false) {
-        if (!isset($topic_urls))
-            throw new Exception('Please specify a topic url');
-        
-        // check that we're working with an array
-        if (!is_array($topic_urls)) {
-            $topic_urls = array($topic_urls);
-        }
-        
-        // set the mode to publish
-        $post_string = "hub.mode=publish";
-        // loop through each topic url 
-        foreach ($topic_urls as $topic_url) {
-
-            // lightweight check that we're actually working w/ a valid url
-            if (!preg_match("|^https?://|i",$topic_url)) 
-                throw new Exception('The specified topic url does not appear to be valid: '.$topic_url);
-            
-            // append the topic url parameters
-            $post_string .= "&hub.url=".urlencode($topic_url);
-        }
-        
-        // make the http post request and return true/false
-        // easy to over-write to use your own http function
-        if ($http_function)
-            return $http_function($this->hub_url,$post_string);
-        else
-            return $this->http_post($this->hub_url,$post_string);
-    }
-
-    // returns any error message from the latest request
-    public function last_response() {
-        return $this->last_response;
-    }
-    
-    // default http function that uses curl to post to the hub endpoint
-    private function http_post($url, $post_string) {
-        
-        // add any additional curl options here
-        $options = array(CURLOPT_URL => $url,
-                         CURLOPT_POST => true,
-                         CURLOPT_POSTFIELDS => $post_string,
-                         CURLOPT_USERAGENT => "PubSubHubbub-Publisher-PHP/1.0");
-
-    	$ch = curl_init();
-    	curl_setopt_array($ch, $options);
-
-        $response = curl_exec($ch);
-        $this->last_response = $response;
-        $info = curl_getinfo($ch);
-
-        curl_close($ch);
-        
-        // all good
-        if ($info['http_code'] == 204) 
-            return true;
-        return false;	
-    }
-}
-
-?>
\ No newline at end of file
diff --git a/plugins/Realtime/RealtimePlugin.php b/plugins/Realtime/RealtimePlugin.php
index e8c44a743..b559d80c6 100644
--- a/plugins/Realtime/RealtimePlugin.php
+++ b/plugins/Realtime/RealtimePlugin.php
@@ -244,8 +244,6 @@ class RealtimePlugin extends Plugin
         // of refactoring from within a plugin, so I'm just abusing
         // the ApiAction method. Don't do this unless you're me!
 
-        require_once(INSTALLDIR.'/lib/api.php');
-
         $act = new ApiAction('/dev/null');
 
         $arr = $act->twitterStatusArray($notice, true);
diff --git a/plugins/Realtime/icon_external.gif b/plugins/Realtime/icon_external.gif
deleted file mode 100644
index c4118d53b..000000000
--- a/plugins/Realtime/icon_external.gif
+++ /dev/null
diff --git a/plugins/Realtime/icon_pause.gif b/plugins/Realtime/icon_pause.gif
deleted file mode 100644
index ced0b6440..000000000
--- a/plugins/Realtime/icon_pause.gif
+++ /dev/null
diff --git a/plugins/Realtime/icon_play.gif b/plugins/Realtime/icon_play.gif
deleted file mode 100644
index 794ec85b6..000000000
--- a/plugins/Realtime/icon_play.gif
+++ /dev/null
diff --git a/plugins/Realtime/realtimeupdate.css b/plugins/Realtime/realtimeupdate.css
index 31e7c2ae6..f43c97de5 100644
--- a/plugins/Realtime/realtimeupdate.css
+++ b/plugins/Realtime/realtimeupdate.css
@@ -64,18 +64,9 @@ float: left;
 }
 
 #realtime_play {
-background: url(icon_play.gif) no-repeat 47% 47%;
 margin-left: 4px;
 }
 
-#realtime_pause {
-background: url(icon_pause.gif) no-repeat 47% 47%;
-}
-
-#realtime_popup {
-background: url(icon_external.gif) no-repeat 0 30%;
-}
-
 #queued_counter {
 float:left;
 line-height:1.2;
diff --git a/plugins/RegisterThrottle/RegisterThrottlePlugin.php b/plugins/RegisterThrottle/RegisterThrottlePlugin.php
new file mode 100644
index 000000000..05709b780
--- /dev/null
+++ b/plugins/RegisterThrottle/RegisterThrottlePlugin.php
@@ -0,0 +1,249 @@
+<?php
+/**
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2010, StatusNet, Inc.
+ *
+ * Throttle registration by IP address
+ *
+ * PHP version 5
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Spam
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * Throttle registration by IP address
+ *
+ * We a) record IP address of registrants and b) throttle registrations.
+ *
+ * @category  Spam
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
+ * @link      http://status.net/
+ */
+
+class RegisterThrottlePlugin extends Plugin
+{
+    /**
+     * Array of time spans in seconds to limits.
+     *
+     * Default is 3 registrations per hour, 5 per day, 10 per week.
+     */
+
+    public $regLimits = array(604800 => 10, // per week
+                              86400 => 5, // per day
+                              3600 => 3); // per hour
+
+    /**
+     * Database schema setup
+     *
+     * We store user registrations in a table registration_ip.
+     *
+     * @return boolean hook value; true means continue processing, false means stop.
+     */
+
+    function onCheckSchema()
+    {
+        $schema = Schema::get();
+
+        // For storing user-submitted flags on profiles
+
+        $schema->ensureTable('registration_ip',
+                             array(new ColumnDef('user_id', 'integer', null,
+                                                 false, 'PRI'),
+                                   new ColumnDef('ipaddress', 'varchar', 15, false, 'MUL'),
+                                   new ColumnDef('created', 'timestamp', null, false, 'MUL')));
+
+        return true;
+    }
+
+    /**
+     * Load related modules when needed
+     *
+     * @param string $cls Name of the class to be loaded
+     *
+     * @return boolean hook value; true means continue processing, false means stop.
+     */
+
+    function onAutoload($cls)
+    {
+        $dir = dirname(__FILE__);
+
+        switch ($cls)
+        {
+        case 'Registration_ip':
+            include_once $dir . '/'.$cls.'.php';
+            return false;
+        default:
+            return true;
+        }
+    }
+
+    /**
+     * Called when someone tries to register.
+     *
+     * We check the IP here to determine if it goes over any of our
+     * configured limits.
+     *
+     * @param Action $action Action that is being executed
+     *
+     * @return boolean hook value
+     *
+     */
+
+    function onStartRegistrationTry($action)
+    {
+        $ipaddress = $this->_getIpAddress();
+
+        if (empty($ipaddress)) {
+            throw new ServerException(_m('Cannot find IP address.'));
+        }
+
+        foreach ($this->regLimits as $seconds => $limit) {
+
+            $this->debug("Checking $seconds ($limit)");
+
+            $reg = $this->_getNthReg($ipaddress, $limit);
+
+            if (!empty($reg)) {
+                $this->debug("Got a {$limit}th registration.");
+                $regtime = strtotime($reg->created);
+                $now     = time();
+                $this->debug("Comparing {$regtime} to {$now}");
+                if ($now - $regtime < $seconds) {
+                    throw new Exception(_("Too many registrations. Take a break and try again later."));
+                }
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Called after someone registers.
+     *
+     * We record the successful registration and IP address.
+     *
+     * @param Action $action Action that is being executed
+     *
+     * @return boolean hook value
+     *
+     */
+
+    function onEndRegistrationTry($action)
+    {
+        $ipaddress = $this->_getIpAddress();
+
+        if (empty($ipaddress)) {
+            throw new ServerException(_m('Cannot find IP address.'));
+        }
+
+        $user = common_current_user();
+
+        if (empty($user)) {
+            throw new ServerException(_m('Cannot find user after successful registration.'));
+        }
+
+        $reg = new Registration_ip();
+
+        $reg->user_id   = $user->id;
+        $reg->ipaddress = $ipaddress;
+
+        $result = $reg->insert();
+
+        if (!$result) {
+            common_log_db_error($reg, 'INSERT', __FILE__);
+            // @todo throw an exception?
+        }
+
+        return true;
+    }
+
+    /**
+     * Check the version of the plugin.
+     *
+     * @param array &$versions Version array.
+     *
+     * @return boolean hook value
+     */
+
+    function onPluginVersion(&$versions)
+    {
+        $versions[] = array('name' => 'RegisterThrottle',
+                            'version' => STATUSNET_VERSION,
+                            'author' => 'Evan Prodromou',
+                            'homepage' => 'http://status.net/wiki/Plugin:RegisterThrottle',
+                            'description' =>
+                            _m('Throttles excessive registration from a single IP.'));
+        return true;
+    }
+
+    /**
+     * Gets the current IP address.
+     *
+     * @return string IP address or null if not found.
+     */
+
+    private function _getIpAddress()
+    {
+        $keys = array('HTTP_X_FORWARDED_FOR',
+                      'CLIENT-IP',
+                      'REMOTE_ADDR');
+
+        foreach ($keys as $k) {
+            if (!empty($_SERVER[$k])) {
+                return $_SERVER[$k];
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Gets the Nth registration with the given IP address.
+     *
+     * @param string  $ipaddress Address to key on
+     * @param integer $n         Nth address
+     *
+     * @return Registration_ip nth registration or null if not found.
+     */
+
+    private function _getNthReg($ipaddress, $n)
+    {
+        $reg = new Registration_ip();
+
+        $reg->ipaddress = $ipaddress;
+
+        $reg->orderBy('created DESC');
+        $reg->limit($n - 1, 1);
+
+        if ($reg->find(true)) {
+            return $reg;
+        } else {
+            return null;
+        }
+    }
+}
diff --git a/plugins/RegisterThrottle/Registration_ip.php b/plugins/RegisterThrottle/Registration_ip.php
new file mode 100644
index 000000000..7e61d089e
--- /dev/null
+++ b/plugins/RegisterThrottle/Registration_ip.php
@@ -0,0 +1,124 @@
+<?php
+/**
+ * Data class for storing IP addresses of new registrants.
+ *
+ * PHP version 5
+ *
+ * @category Data
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ *
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2010, StatusNet, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.     See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+require_once INSTALLDIR . '/classes/Memcached_DataObject.php';
+
+/**
+ * Data class for storing IP addresses of new registrants.
+ *
+ * @category Spam
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class Registration_ip extends Memcached_DataObject
+{
+    public $__table = 'registration_ip';     // table name
+    public $user_id;                         // int(4)  primary_key not_null
+    public $ipaddress;                       // varchar(15)
+    public $created;                         // timestamp
+
+    /**
+     * Get an instance by key
+     *
+     * @param string $k Key to use to lookup (usually 'user_id' for this class)
+     * @param mixed  $v Value to lookup
+     *
+     * @return User_greeting_count object found, or null for no hits
+     *
+     */
+
+    function staticGet($k, $v=null)
+    {
+        return Memcached_DataObject::staticGet('Registration_ip', $k, $v);
+    }
+
+    /**
+     * return table definition for DB_DataObject
+     *
+     * @return array array of column definitions
+     */
+
+    function table()
+    {
+        return array('user_id' => DB_DATAOBJECT_INT + DB_DATAOBJECT_NOTNULL,
+                     'ipaddress' => DB_DATAOBJECT_STR + DB_DATAOBJECT_NOTNULL,
+                     'created' => DB_DATAOBJECT_MYSQLTIMESTAMP + DB_DATAOBJECT_NOTNULL);
+    }
+
+    /**
+     * return key definitions for DB_DataObject
+     *
+     * DB_DataObject needs to know about keys that the table has; this function
+     * defines them.
+     *
+     * @return array key definitions
+     */
+
+    function keys()
+    {
+        return array('user_id' => 'K');
+    }
+
+    /**
+     * return key definitions for Memcached_DataObject
+     *
+     * Our caching system uses the same key definitions, but uses a different
+     * method to get them.
+     *
+     * @return array key definitions
+     */
+
+    function keyTypes()
+    {
+        return $this->keys();
+    }
+
+    /**
+     * Magic formula for non-autoincrementing integer primary keys
+     *
+     * If a table has a single integer column as its primary key, DB_DataObject
+     * assumes that the column is auto-incrementing and makes a sequence table
+     * to do this incrementation. Since we don't need this for our class, we
+     * overload this method and return the magic formula that DB_DataObject needs.
+     *
+     * @return array magic three-false array that stops auto-incrementing.
+     */
+
+    function sequenceKey()
+    {
+        return array(false, false, false);
+    }
+}
diff --git a/plugins/ReverseUsernameAuthentication/README b/plugins/ReverseUsernameAuthentication/README
index e9160ed9b..57b53219e 100644
--- a/plugins/ReverseUsernameAuthentication/README
+++ b/plugins/ReverseUsernameAuthentication/README
@@ -8,7 +8,10 @@ add "addPlugin('reverseUsernameAuthentication', array('setting'=>'value', 'setti
 
 Settings
 ========
-provider_name*: a unique name for this authentication provider.
+provider_name*: This is a identifier designated to the connection.
+    It's how StatusNet will refer to the authentication source.
+    For the most part, any name can be used, so long as each authentication source has a different identifier.
+    In most cases there will be only one authentication source used.
 password_changeable*: must be set to false. This plugin does not support changing passwords.
 authoritative (false): Set to true if this plugin's responses are authoritative (meaning if this fails, do check any other plugins or the internal password database).
 autoregistration (false): Set to true if users should be automatically created when they attempt to login.
diff --git a/plugins/Sample/locale/Sample.po b/plugins/Sample/locale/Sample.po
index e0d2aa853..a52c4ec01 100644
--- a/plugins/Sample/locale/Sample.po
+++ b/plugins/Sample/locale/Sample.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2010-02-24 16:33-0800\n"
+"POT-Creation-Date: 2010-03-01 14:58-0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
diff --git a/plugins/SphinxSearch/sphinxsearch.php b/plugins/SphinxSearch/sphinxsearch.php
index 71f330828..654b9c9d5 100644
--- a/plugins/SphinxSearch/sphinxsearch.php
+++ b/plugins/SphinxSearch/sphinxsearch.php
@@ -75,7 +75,7 @@ class SphinxSearch extends SearchEngine
     {
         if ('chron' === $mode) {
             $this->sphinx->SetSortMode(SPH_SORT_ATTR_DESC, 'created_ts');
-            return $this->target->orderBy('created desc');
+            return $this->target->orderBy('id desc');
         }
     }
 
diff --git a/plugins/TabFocus/TabFocusPlugin.php b/plugins/TabFocus/TabFocusPlugin.php
new file mode 100644
index 000000000..bf89c478c
--- /dev/null
+++ b/plugins/TabFocus/TabFocusPlugin.php
@@ -0,0 +1,57 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Plugin to enable Twitter-like "tab-space" pattern for a user to submit a notice
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Plugin
+ * @package   StatusNet
+ * @author    Craig Andrews <candrews@integralblue.com>
+ * @author    Paul Irish <paul.irish@isobar.net>
+ * @copyright 2009 Craig Andrews http://candrews.integralblue.com
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET') && !defined('LACONICA')) {
+    exit(1);
+}
+
+class TabFocusPlugin extends Plugin
+{
+    function __construct()
+    {
+        parent::__construct();
+    }
+
+    function onEndShowScripts($action)
+    {
+        $action->script('plugins/TabFocus/tabfocus.js');
+    }
+
+    function onPluginVersion(&$versions)
+    {
+        $versions[] = array('name' => 'TabFocus',
+                            'version' => STATUSNET_VERSION,
+                            'author' => 'Craig Andrews and Paul Irish',
+                            'homepage' => 'http://status.net/wiki/Plugin:TabFocus',
+                            'rawdescription' =>
+                            _m('TabFocus changes the notice form behavior so that, while in the text area, pressing the tab key focuses the "Send" button, matching the behavor of Twitter.'));
+        return true;
+    }
+}
diff --git a/plugins/TabFocus/tabfocus.js b/plugins/TabFocus/tabfocus.js
new file mode 100644
index 000000000..e2c1c6521
--- /dev/null
+++ b/plugins/TabFocus/tabfocus.js
@@ -0,0 +1,7 @@
+jQuery(function($){
+  $('#notice_data-text').bind('keydown',function(e){
+    if (e.which==9) {
+      setTimeout(function(){  $('#notice_action-submit').focus();  },15);
+    }
+  });
+});
diff --git a/plugins/TwitterBridge/README b/plugins/TwitterBridge/README
index d3bcda598..d0d34b7ef 100644
--- a/plugins/TwitterBridge/README
+++ b/plugins/TwitterBridge/README
@@ -1,47 +1,104 @@
+Twitter Bridge Plugin
+=====================
+
 This Twitter "bridge" plugin allows you to integrate your StatusNet
 instance with Twitter.  Installing it will allow your users to:
 
-    - automatically post notices to thier Twitter accounts
+    - automatically post notices to their Twitter accounts
     - automatically subscribe to other Twitter users who are also using
       your StatusNet install, if possible (requires running a daemon)
     - import their Twitter friends' tweets (requires running a daemon)
+    - allow users to authenticate using Twitter ('Sign in with Twitter')
 
 Installation
 ------------
 
-To enable the plugin, add the following to your config.php:
-
-    addPlugin("TwitterBridge");
-
-OAuth is used to to access protected resources on Twitter (as opposed to
-HTTP Basic Auth)*.  To use Twitter bridging you will need to register
-your instance of StatusNet as an application on Twitter
-(http://twitter.com/apps), and update the following variables in your
-config.php with the consumer key and secret Twitter generates for you:
-
-    $config['twitter']['consumer_key']    = 'YOURKEY';
-    $config['twitter']['consumer_secret'] = 'YOURSECRET';
+OAuth 1.0a (http://oauth.net) is used to to access protected resources
+on Twitter (as opposed to HTTP Basic Auth)*.  To use Twitter bridging
+you will need to register your instance of StatusNet as an application
+on Twitter (http://twitter.com/apps).  During the application
+registration process your application will be assigned a "consumer" key
+and secret, which the plugin will use to make OAuth requests to Twitter.
+You can either pass the consumer key and secret in when you enable the
+plugin, or set it using the Twitter administration panel**.
 
 When registering your application with Twitter set the type to "Browser"
 and your Callback URL to:
 
     http://example.org/mublog/twitter/authorization
 
-The default access type should be, "Read & Write".
+(Change "example.org" to your site domain and "mublog" to your site
+path.)
+
+The default access type should be "Read & Write".
+
+To enable the plugin, add the following to your config.php:
+
+    addPlugin(
+        'TwitterBridge',
+        array(
+            'consumer_key'    => 'YOUR_CONSUMER_KEY',
+            'consumer_secret' => 'YOUR_CONSUMER_SECRET'
+        )
+    );
+
+or just:
+
+   addPlugin('TwitterBridge');
+
+if you want to set the consumer key and secret from the Twitter bridge
+administration panel.  (The Twitter bridge wont work at all
+unless you configure it with a consumer key and secret.)
 
 * Note: The plugin will still push notices to Twitter for users who
-  have previously setup the Twitter bridge using their Twitter name and
-  password under an older versions of StatusNet, but all new Twitter
+  have previously set up the Twitter bridge using their Twitter name and
+  password under an older version of StatusNet, but all new Twitter
   bridge connections will use OAuth.
 
-Deamons
+** For multi-site setups you can also set a global consumer key and
+   secret.  The Twitter bridge will fall back on the global key pair if
+   it can't find a local pair, e.g.:
+
+   $config['twitter']['global_consumer_key']    = 'YOUR_CONSUMER_KEY'
+   $config['twitter']['global_consumer_secret'] = 'YOUR_CONSUMER_SECRET'
+
+Administration panel
+--------------------
+
+As of StatusNet 0.9.0 there is a new administration panel that allows
+you to configure Twitter bridge settings within StatusNet itself,
+instead of having to specify them manually in your config.php.  To enable
+the administration panel, you will need to add it to the list of active
+administration panels.  You can do this via your config.php. E.g.:
+
+    $config['admin']['panels'][] = 'twitter';
+
+And to access it, you'll need to use a user with the "administrator"
+role (see: scripts/userrole.php).
+
+Sign in with Twitter
+--------------------
+
+With 0.9.0, StatusNet optionally allows users to register and
+authenticate using their Twitter credentials via the "Sign in with
+Twitter" pattern described here:
+
+    http://apiwiki.twitter.com/Sign-in-with-Twitter
+
+The option is _on_ by default when you install the plugin, but it can
+disabled via the Twitter bridge administration panel, or by adding the
+following line to your config.php:
+
+    $config['twitter']['signin'] = false;
+
+Daemons
 -------
 
-For friend syncing and importing notices running two additional daemon
-scripts is necessary (synctwitterfriends.php and
-twitterstatusfetcher.php).
+For friend syncing and importing Twitter tweets, running two
+additional daemon scripts is necessary: synctwitterfriends.php and
+twitterstatusfetcher.php.
 
-In the daemons subidrectory of the plugin are three scripts:
+In the daemons subdirectory of the plugin are three scripts:
 
 * Twitter Friends Syncing (daemons/synctwitterfriends.php)
 
@@ -51,13 +108,13 @@ subscribe to "friends" (people they "follow") on Twitter who also have
 accounts on your StatusNet system, and who have previously set up a link
 for automatically posting notices to Twitter.
 
-The plugin will try to start this daemon when you run
-scripts/startdaemons.sh.
+The plugin will start this daemon when you run scripts/startdaemons.sh.
 
 * Importing statuses from Twitter (daemons/twitterstatusfetcher.php)
 
-To allow your users to import their friends' Twitter statuses, you will
-need to enable the bidirectional Twitter bridge in your config.php:
+You can allow uses to enable importing of your friends' Twitter
+timelines either in the Twitter bridge administration panel or in your
+config.php using the following configuration line:
 
     $config['twitterimport']['enabled'] = true;
 
@@ -66,8 +123,9 @@ other daemons when you run scripts/startdaemons.sh.
 
 Additionally, you will want to set the integration source variable,
 which will keep notices posted to Twitter via StatusNet from looping
-back.  The integration source should be set to the name of your
-application, exactly as you specified it on the settings page for your
+back.  You can do this in the Twitter bridge administration panel, or
+via config.php. The integration source should be set to the name of your
+application _exactly_ as you specified it on the settings page for your
 StatusNet application on Twitter, e.g.:
 
     $config['integration']['source'] = 'YourApp';
@@ -79,7 +137,9 @@ set up Twitter bridging.
 
 It's not strictly necessary to run this queue handler, and sites that
 haven't enabled queuing are still able to push notices to Twitter, but
-for larger sites and sites that wish to improve performance, this
-script allows notices to be sent "offline" via a separate process.
+for larger sites and sites that wish to improve performance the script
+allows notices to be sent "offline" via a separate process.
 
-The plugin will start this script when you run scripts/startdaemons.sh.
+StatusNet will automatically use the TwitterQueueHandler if you have
+enabled the queuing subsystem.  See the "Queues and daemons" section of
+the main README file for more information about how to do that.
diff --git a/plugins/TwitterBridge/TwitterBridgePlugin.php b/plugins/TwitterBridge/TwitterBridgePlugin.php
index c7f57ffc7..1a0a69682 100644
--- a/plugins/TwitterBridge/TwitterBridgePlugin.php
+++ b/plugins/TwitterBridge/TwitterBridgePlugin.php
@@ -23,7 +23,7 @@
  * @author    Julien C <chaumond@gmail.com>
  * @copyright 2009-2010 Control Yourself, Inc.
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
- * @link      http://laconi.ca/
+ * @link      http://status.net/
  */
 
 if (!defined('STATUSNET')) {
@@ -32,8 +32,6 @@ if (!defined('STATUSNET')) {
 
 require_once INSTALLDIR . '/plugins/TwitterBridge/twitter.php';
 
-define('TWITTERBRIDGEPLUGIN_VERSION', '0.9');
-
 /**
  * Plugin for sending and importing Twitter statuses
  *
@@ -44,19 +42,65 @@ define('TWITTERBRIDGEPLUGIN_VERSION', '0.9');
  * @author   Zach Copley <zach@status.net>
  * @author   Julien C <chaumond@gmail.com>
  * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
- * @link     http://laconi.ca/
+ * @link     http://status.net/
  * @link     http://twitter.com/
  */
 
 class TwitterBridgePlugin extends Plugin
 {
+
+    const VERSION = STATUSNET_VERSION;
+
     /**
      * Initializer for the plugin.
      */
 
-    function __construct()
+    function initialize()
     {
-        parent::__construct();
+        // Allow the key and secret to be passed in
+        // Control panel will override
+
+        if (isset($this->consumer_key)) {
+            $key = common_config('twitter', 'consumer_key');
+            if (empty($key)) {
+                Config::save('twitter', 'consumer_key', $this->consumer_key);
+            }
+        }
+
+        if (isset($this->consumer_secret)) {
+            $secret = common_config('twitter', 'consumer_secret');
+            if (empty($secret)) {
+                Config::save(
+                    'twitter',
+                    'consumer_secret',
+                    $this->consumer_secret
+                );
+            }
+        }
+    }
+
+    /**
+     * Check to see if there is a consumer key and secret defined
+     * for Twitter integration.
+     *
+     * @return boolean result
+     */
+
+    static function hasKeys()
+    {
+        $ckey    = common_config('twitter', 'consumer_key');
+        $csecret = common_config('twitter', 'consumer_secret');
+
+        if (empty($ckey) && empty($csecret)) {
+            $ckey    = common_config('twitter', 'global_consumer_key');
+            $csecret = common_config('twitter', 'global_consumer_secret');
+        }
+
+        if (!empty($ckey) && !empty($csecret)) {
+            return true;
+        }
+
+        return false;
     }
 
     /**
@@ -71,10 +115,25 @@ class TwitterBridgePlugin extends Plugin
 
     function onRouterInitialized($m)
     {
-        $m->connect('twitter/authorization',
-                    array('action' => 'twitterauthorization'));
-        $m->connect('settings/twitter', array('action' => 'twittersettings'));
-        $m->connect('main/twitterlogin', array('action' => 'twitterlogin'));
+        $m->connect('admin/twitter', array('action' => 'twitteradminpanel'));
+
+        if (self::hasKeys()) {
+            $m->connect(
+                'twitter/authorization',
+                array('action' => 'twitterauthorization')
+            );
+            $m->connect(
+                'settings/twitter', array(
+                    'action' => 'twittersettings'
+                    )
+                );
+            if (common_config('twitter', 'signin')) {
+                $m->connect(
+                    'main/twitterlogin',
+                    array('action' => 'twitterlogin')
+                );
+            }
+        }
 
         return true;
     }
@@ -88,13 +147,16 @@ class TwitterBridgePlugin extends Plugin
      */
     function onEndLoginGroupNav(&$action)
     {
-
         $action_name = $action->trimmed('action');
 
-        $action->menuItem(common_local_url('twitterlogin'),
-                                           _('Twitter'),
-                                           _('Login or register using Twitter'),
-                                             'twitterlogin' === $action_name);
+        if (self::hasKeys() && common_config('twitter', 'signin')) {
+            $action->menuItem(
+                common_local_url('twitterlogin'),
+                _m('Twitter'),
+                _m('Login or register using Twitter'),
+                'twitterlogin' === $action_name
+            );
+        }
 
         return true;
     }
@@ -108,13 +170,16 @@ class TwitterBridgePlugin extends Plugin
      */
     function onEndConnectSettingsNav(&$action)
     {
-        $action_name = $action->trimmed('action');
-
-        $action->menuItem(common_local_url('twittersettings'),
-                          _m('Twitter'),
-                          _m('Twitter integration options'),
-                          $action_name === 'twittersettings');
+        if (self::hasKeys()) {
+            $action_name = $action->trimmed('action');
 
+            $action->menuItem(
+                common_local_url('twittersettings'),
+                _m('Twitter'),
+                _m('Twitter integration options'),
+                $action_name === 'twittersettings'
+            );
+        }
         return true;
     }
 
@@ -132,6 +197,7 @@ class TwitterBridgePlugin extends Plugin
         case 'TwittersettingsAction':
         case 'TwitterauthorizationAction':
         case 'TwitterloginAction':
+        case 'TwitteradminpanelAction':
             include_once INSTALLDIR . '/plugins/TwitterBridge/' .
               strtolower(mb_substr($cls, 0, -6)) . '.php';
             return false;
@@ -155,12 +221,12 @@ class TwitterBridgePlugin extends Plugin
      */
     function onStartEnqueueNotice($notice, &$transports)
     {
-        // Avoid a possible loop
-
-        if ($notice->source != 'twitter') {
-            array_push($transports, 'twitter');
+        if (self::hasKeys()) {
+            // Avoid a possible loop
+            if ($notice->source != 'twitter') {
+                array_push($transports, 'twitter');
+            }
         }
-
         return true;
     }
 
@@ -173,12 +239,19 @@ class TwitterBridgePlugin extends Plugin
      */
     function onGetValidDaemons($daemons)
     {
-        array_push($daemons, INSTALLDIR .
-                   '/plugins/TwitterBridge/daemons/synctwitterfriends.php');
-
-        if (common_config('twitterimport', 'enabled')) {
-            array_push($daemons, INSTALLDIR
-                . '/plugins/TwitterBridge/daemons/twitterstatusfetcher.php');
+        if (self::hasKeys()) {
+            array_push(
+                $daemons,
+                INSTALLDIR
+                . '/plugins/TwitterBridge/daemons/synctwitterfriends.php'
+            );
+            if (common_config('twitterimport', 'enabled')) {
+                array_push(
+                    $daemons,
+                    INSTALLDIR
+                    . '/plugins/TwitterBridge/daemons/twitterstatusfetcher.php'
+                    );
+            }
         }
 
         return true;
@@ -193,21 +266,61 @@ class TwitterBridgePlugin extends Plugin
      */
     function onEndInitializeQueueManager($manager)
     {
-        $manager->connect('twitter', 'TwitterQueueHandler');
+        if (self::hasKeys()) {
+            $manager->connect('twitter', 'TwitterQueueHandler');
+        }
         return true;
     }
 
+    /**
+     * Add a Twitter tab to the admin panel
+     *
+     * @param Widget $nav Admin panel nav
+     *
+     * @return boolean hook value
+     */
+
+    function onEndAdminPanelNav($nav)
+    {
+        if (AdminPanelAction::canAdmin('twitter')) {
+
+            $action_name = $nav->action->trimmed('action');
+
+            $nav->out->menuItem(
+                common_local_url('twitteradminpanel'),
+                _m('Twitter'),
+                _m('Twitter bridge configuration'),
+                $action_name == 'twitteradminpanel',
+                'nav_twitter_admin_panel'
+            );
+        }
+
+        return true;
+    }
+
+    /**
+     * Plugin version data
+     *
+     * @param array &$versions array of version blocks
+     *
+     * @return boolean hook value
+     */
+
     function onPluginVersion(&$versions)
     {
-        $versions[] = array('name' => 'TwitterBridge',
-                            'version' => TWITTERBRIDGEPLUGIN_VERSION,
-                            'author' => 'Zach Copley',
-                            'homepage' => 'http://status.net/wiki/Plugin:TwitterBridge',
-                            'rawdescription' =>
-                            _m('The Twitter "bridge" plugin allows you to integrate ' .
-                               'your StatusNet instance with ' .
-                               '<a href="http://twitter.com/">Twitter</a>.'));
+        $versions[] = array(
+            'name' => 'TwitterBridge',
+            'version' => self::VERSION,
+            'author' => 'Zach Copley, Julien C',
+            'homepage' => 'http://status.net/wiki/Plugin:TwitterBridge',
+            'rawdescription' => _m(
+                'The Twitter "bridge" plugin allows you to integrate ' .
+                'your StatusNet instance with ' .
+                '<a href="http://twitter.com/">Twitter</a>.'
+            )
+        );
         return true;
     }
 
 }
+
diff --git a/plugins/TwitterBridge/daemons/synctwitterfriends.php b/plugins/TwitterBridge/daemons/synctwitterfriends.php
index 671e3c7af..df7da0943 100755
--- a/plugins/TwitterBridge/daemons/synctwitterfriends.php
+++ b/plugins/TwitterBridge/daemons/synctwitterfriends.php
@@ -221,7 +221,7 @@ class SyncTwitterFriendsDaemon extends ParallelizingDaemon
             // Twitter friend
 
             if (!save_twitter_user($friend_id, $friend_name)) {
-                common_log(LOG_WARNING, $this-name() .
+                common_log(LOG_WARNING, $this->name() .
                            " - Couldn't save $screen_name's friend, $friend_name.");
                 continue;
             }
diff --git a/plugins/TwitterBridge/locale/TwitterBridge.po b/plugins/TwitterBridge/locale/TwitterBridge.po
index 14c30f1c9..eff125579 100644
--- a/plugins/TwitterBridge/locale/TwitterBridge.po
+++ b/plugins/TwitterBridge/locale/TwitterBridge.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2009-12-07 20:38-0800\n"
+"POT-Creation-Date: 2010-03-01 14:58-0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -16,23 +16,48 @@ msgstr ""
 "Content-Type: text/plain; charset=CHARSET\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: twitterauthorization.php:81
-msgid "Not logged in."
+#: twitter.php:320
+msgid "Your Twitter bridge has been disabled."
 msgstr ""
 
-#: twitterauthorization.php:131 twitterauthorization.php:150
-#: twitterauthorization.php:170 twitterauthorization.php:217
+#: twitter.php:324
+#, php-format
+msgid ""
+"Hi, %1$s. We're sorry to inform you that your link to Twitter has been "
+"disabled. We no longer seem to have permission to update your Twitter "
+"status. (Did you revoke %3$s's access?)\n"
+"\n"
+"You can re-enable your Twitter bridge by visiting your Twitter settings "
+"page:\n"
+"\n"
+"\t%2$s\n"
+"\n"
+"Regards,\n"
+"%3$s\n"
+msgstr ""
+
+#: twitterauthorization.php:181 twitterauthorization.php:229
 msgid "Couldn't link your Twitter account."
 msgstr ""
 
-#: TwitterBridgePlugin.php:89
+#: twitterauthorization.php:201
+msgid "Couldn't link your Twitter account: oauth_token mismatch."
+msgstr ""
+
+#: TwitterBridgePlugin.php:114
 msgid "Twitter"
 msgstr ""
 
-#: TwitterBridgePlugin.php:90
+#: TwitterBridgePlugin.php:115
 msgid "Twitter integration options"
 msgstr ""
 
+#: TwitterBridgePlugin.php:207
+msgid ""
+"The Twitter \"bridge\" plugin allows you to integrate your StatusNet "
+"instance with <a href=\"http://twitter.com/\">Twitter</a>."
+msgstr ""
+
 #: twittersettings.php:59
 msgid "Twitter settings"
 msgstr ""
@@ -51,78 +76,81 @@ msgstr ""
 msgid "Connected Twitter account"
 msgstr ""
 
-#: twittersettings.php:125
-msgid "Remove"
+#: twittersettings.php:128
+msgid "Disconnect my account from Twitter"
+msgstr ""
+
+#: twittersettings.php:133
+msgid "Disconnecting your Twitter could make it impossible to log in! Please "
+msgstr ""
+
+#: twittersettings.php:137
+msgid "set a password"
 msgstr ""
 
-#: twittersettings.php:131
+#: twittersettings.php:139
+msgid " first."
+msgstr ""
+
+#: twittersettings.php:143
+#, php-format
+msgid ""
+"Keep your %1$s account but disconnect from Twitter. You can use your %1$s "
+"password to log in."
+msgstr ""
+
+#: twittersettings.php:151
+msgid "Disconnect"
+msgstr ""
+
+#: twittersettings.php:158
 msgid "Preferences"
 msgstr ""
 
-#: twittersettings.php:135
+#: twittersettings.php:162
 msgid "Automatically send my notices to Twitter."
 msgstr ""
 
-#: twittersettings.php:142
+#: twittersettings.php:169
 msgid "Send local \"@\" replies to Twitter."
 msgstr ""
 
-#: twittersettings.php:149
+#: twittersettings.php:176
 msgid "Subscribe to my Twitter friends here."
 msgstr ""
 
-#: twittersettings.php:158
+#: twittersettings.php:185
 msgid "Import my Friends Timeline."
 msgstr ""
 
-#: twittersettings.php:174
+#: twittersettings.php:201
 msgid "Save"
 msgstr ""
 
-#: twittersettings.php:176
+#: twittersettings.php:203
 msgid "Add"
 msgstr ""
 
-#: twittersettings.php:201
+#: twittersettings.php:228
 msgid "There was a problem with your session token. Try again, please."
 msgstr ""
 
-#: twittersettings.php:211
+#: twittersettings.php:238
 msgid "Unexpected form submission."
 msgstr ""
 
-#: twittersettings.php:230
+#: twittersettings.php:257
 msgid "Couldn't remove Twitter user."
 msgstr ""
 
-#: twittersettings.php:234
-msgid "Twitter account removed."
+#: twittersettings.php:261
+msgid "Twitter account disconnected."
 msgstr ""
 
-#: twittersettings.php:255 twittersettings.php:265
+#: twittersettings.php:282 twittersettings.php:292
 msgid "Couldn't save Twitter preferences."
 msgstr ""
 
-#: twittersettings.php:269
+#: twittersettings.php:296
 msgid "Twitter preferences saved."
 msgstr ""
-
-#: twitter.php:333
-msgid "Your Twitter bridge has been disabled."
-msgstr ""
-
-#: twitter.php:337
-#, php-format
-msgid ""
-"Hi, %1$s. We're sorry to inform you that your link to Twitter has been "
-"disabled. We no longer seem to have permission to update your Twitter "
-"status. (Did you revoke %3$s's access?)\n"
-"\n"
-"You can re-enable your Twitter bridge by visiting your Twitter settings "
-"page:\n"
-"\n"
-"\t%2$s\n"
-"\n"
-"Regards,\n"
-"%3$s\n"
-msgstr ""
diff --git a/plugins/TwitterBridge/twitter.php b/plugins/TwitterBridge/twitter.php
index 13e499d65..2805b3ab5 100644
--- a/plugins/TwitterBridge/twitter.php
+++ b/plugins/TwitterBridge/twitter.php
@@ -273,7 +273,7 @@ function remove_twitter_link($flink)
     common_log(LOG_INFO, 'Removing Twitter bridge Foreign link for ' .
                "user $user->nickname (user id: $user->id).");
 
-    $result = $flink->delete();
+    $result = $flink->safeDelete();
 
     if (empty($result)) {
         common_log(LOG_ERR, 'Could not remove Twitter bridge ' .
diff --git a/plugins/TwitterBridge/twitteradminpanel.php b/plugins/TwitterBridge/twitteradminpanel.php
new file mode 100644
index 000000000..a78a92c66
--- /dev/null
+++ b/plugins/TwitterBridge/twitteradminpanel.php
@@ -0,0 +1,289 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Twitter bridge administration panel
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Settings
+ * @package   StatusNet
+ * @author    Zach Copley <zach@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * Administer global Twitter bridge settings
+ *
+ * @category Admin
+ * @package  StatusNet
+ * @author   Zach Copley <zach@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link     http://status.net/
+ */
+
+class TwitteradminpanelAction extends AdminPanelAction
+{
+    /**
+     * Returns the page title
+     *
+     * @return string page title
+     */
+
+    function title()
+    {
+        return _m('Twitter');
+    }
+
+    /**
+     * Instructions for using this form.
+     *
+     * @return string instructions
+     */
+
+    function getInstructions()
+    {
+        return _m('Twitter bridge settings');
+    }
+
+    /**
+     * Show the Twitter admin panel form
+     *
+     * @return void
+     */
+
+    function showForm()
+    {
+        $form = new TwitterAdminPanelForm($this);
+        $form->show();
+        return;
+    }
+
+    /**
+     * Save settings from the form
+     *
+     * @return void
+     */
+
+    function saveSettings()
+    {
+        static $settings = array(
+            'twitter'     => array('consumer_key', 'consumer_secret'),
+            'integration' => array('source')
+        );
+
+        static $booleans = array(
+            'twitter'       => array('signin'),
+            'twitterimport' => array('enabled')
+        );
+
+        $values = array();
+
+        foreach ($settings as $section => $parts) {
+            foreach ($parts as $setting) {
+                $values[$section][$setting]
+                    = $this->trimmed($setting);
+            }
+        }
+
+        foreach ($booleans as $section => $parts) {
+            foreach ($parts as $setting) {
+                $values[$section][$setting]
+                    = ($this->boolean($setting)) ? 1 : 0;
+            }
+        }
+
+        // This throws an exception on validation errors
+
+        $this->validate($values);
+
+        // assert(all values are valid);
+
+        $config = new Config();
+
+        $config->query('BEGIN');
+
+        foreach ($settings as $section => $parts) {
+            foreach ($parts as $setting) {
+                Config::save($section, $setting, $values[$section][$setting]);
+            }
+        }
+
+        foreach ($booleans as $section => $parts) {
+            foreach ($parts as $setting) {
+                Config::save($section, $setting, $values[$section][$setting]);
+            }
+        }
+
+        $config->query('COMMIT');
+
+        return;
+    }
+
+    function validate(&$values)
+    {
+        // Validate consumer key and secret (can't be too long)
+
+        if (mb_strlen($values['twitter']['consumer_key']) > 255) {
+            $this->clientError(
+                _m("Invalid consumer key. Max length is 255 characters.")
+            );
+        }
+
+        if (mb_strlen($values['twitter']['consumer_secret']) > 255) {
+            $this->clientError(
+                _m("Invalid consumer secret. Max length is 255 characters.")
+            );
+        }
+    }
+}
+
+class TwitterAdminPanelForm extends AdminForm
+{
+    /**
+     * ID of the form
+     *
+     * @return int ID of the form
+     */
+
+    function id()
+    {
+        return 'twitteradminpanel';
+    }
+
+    /**
+     * class of the form
+     *
+     * @return string class of the form
+     */
+
+    function formClass()
+    {
+        return 'form_settings';
+    }
+
+    /**
+     * Action of the form
+     *
+     * @return string URL of the action
+     */
+
+    function action()
+    {
+        return common_local_url('twitteradminpanel');
+    }
+
+    /**
+     * Data elements of the form
+     *
+     * @return void
+     */
+
+    function formData()
+    {
+        $this->out->elementStart(
+            'fieldset',
+            array('id' => 'settings_twitter-application')
+        );
+        $this->out->element('legend', null, _m('Twitter application settings'));
+        $this->out->elementStart('ul', 'form_data');
+
+        $this->li();
+        $this->input(
+            'consumer_key',
+            _m('Consumer key'),
+            _m('Consumer key assigned by Twitter'),
+            'twitter'
+        );
+        $this->unli();
+
+        $this->li();
+        $this->input(
+            'consumer_secret',
+             _m('Consumer secret'),
+            _m('Consumer secret assigned by Twitter'),
+            'twitter'
+        );
+        $this->unli();
+
+        $globalConsumerKey = common_config('twitter', 'global_consumer_key');
+        $globalConsumerSec = common_config('twitter', 'global_consumer_secret');
+
+        if (!empty($globalConsumerKey) && !empty($globalConsumerSec)) {
+            $this->li();
+            $this->out->element('p', 'form_guide', _('Note: a global consumer key and secret are set.'));
+            $this->unli();
+        }
+
+        $this->li();
+        $this->input(
+            'source',
+             _m('Integration source'),
+            _m('Name of your Twitter application'),
+            'integration'
+        );
+        $this->unli();
+
+        $this->out->elementEnd('ul');
+        $this->out->elementEnd('fieldset');
+
+        $this->out->elementStart(
+            'fieldset',
+            array('id' => 'settings_twitter-options')
+        );
+        $this->out->element('legend', null, _m('Options'));
+
+        $this->out->elementStart('ul', 'form_data');
+
+        $this->li();
+
+        $this->out->checkbox(
+            'signin', _m('Enable "Sign-in with Twitter"'),
+            (bool) $this->value('signin', 'twitter'),
+            _m('Allow users to login with their Twitter credentials')
+        );
+        $this->unli();
+
+        $this->li();
+        $this->out->checkbox(
+            'enabled', _m('Enable Twitter import'),
+            (bool) $this->value('enabled', 'twitterimport'),
+            _m('Allow users to import their Twitter friends\' timelines')
+        );
+        $this->unli();
+
+        $this->out->elementEnd('ul');
+
+        $this->out->elementEnd('fieldset');
+    }
+
+    /**
+     * Action elements
+     *
+     * @return void
+     */
+
+    function formActions()
+    {
+        $this->out->submit('submit', _('Save'), 'submit', null, _('Save Twitter settings'));
+    }
+}
diff --git a/plugins/TwitterBridge/twitterauthorization.php b/plugins/TwitterBridge/twitterauthorization.php
index cabf69d7a..bc004cb95 100644
--- a/plugins/TwitterBridge/twitterauthorization.php
+++ b/plugins/TwitterBridge/twitterauthorization.php
@@ -47,7 +47,7 @@ require_once INSTALLDIR . '/plugins/TwitterBridge/twitter.php';
  * @author   Zach Copley <zach@status.net>
  * @author   Julien C <chaumond@gmail.com>
  * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
- * @link     http://laconi.ca/
+ * @link     http://status.net/
  *
  */
 class TwitterauthorizationAction extends Action
@@ -273,7 +273,13 @@ class TwitterauthorizationAction extends Action
 
         $flink->user_id = $user_id;
         $flink->service = TWITTER_SERVICE;
-        $flink->delete(); // delete stale flink, if any
+
+        // delete stale flink, if any
+        $result = $flink->find(true);
+
+        if (!empty($result)) {
+            $flink->safeDelete();
+        }
 
         $flink->user_id     = $user_id;
         $flink->foreign_id  = $twuid;
@@ -455,6 +461,11 @@ class TwitterauthorizationAction extends Action
 
         $user = User::register($args);
 
+        if (empty($user)) {
+            $this->serverError(_('Error registering user.'));
+            return;
+        }
+
         $result = $this->saveForeignLink($user->id,
                                          $this->twuid,
                                          $this->access_token);
diff --git a/plugins/TwitterBridge/twitteroauthclient.php b/plugins/TwitterBridge/twitteroauthclient.php
index ba45b533d..93f6aadd1 100644
--- a/plugins/TwitterBridge/twitteroauthclient.php
+++ b/plugins/TwitterBridge/twitteroauthclient.php
@@ -22,7 +22,7 @@
  * @category  Integration
  * @package   StatusNet
  * @author    Zach Copley <zach@status.net>
- * @copyright 2009 StatusNet, Inc.
+ * @copyright 2009-2010 StatusNet, Inc.
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  * @link      http://status.net/
  */
@@ -61,8 +61,23 @@ class TwitterOAuthClient extends OAuthClient
         $consumer_key    = common_config('twitter', 'consumer_key');
         $consumer_secret = common_config('twitter', 'consumer_secret');
 
-        parent::__construct($consumer_key, $consumer_secret,
-                            $oauth_token, $oauth_token_secret);
+        if (empty($consumer_key) && empty($consumer_secret)) {
+            $consumer_key = common_config(
+                'twitter',
+                'global_consumer_key'
+            );
+            $consumer_secret = common_config(
+                'twitter',
+                'global_consumer_secret'
+            );
+        }
+
+        parent::__construct(
+            $consumer_key,
+            $consumer_secret,
+            $oauth_token,
+            $oauth_token_secret
+        );
     }
 
     // XXX: the following two functions are to support the horrible hack
diff --git a/plugins/TwitterBridge/twittersettings.php b/plugins/TwitterBridge/twittersettings.php
index 0137060e9..631b29f52 100644
--- a/plugins/TwitterBridge/twittersettings.php
+++ b/plugins/TwitterBridge/twittersettings.php
@@ -250,7 +250,7 @@ class TwittersettingsAction extends ConnectSettingsAction
         $user = common_current_user();
         $flink = Foreign_link::getByUserID($user->id, TWITTER_SERVICE);
 
-        $result = $flink->delete();
+        $result = $flink->safeDelete();
 
         if (empty($result)) {
             common_log_db_error($flink, 'DELETE', __FILE__);
diff --git a/plugins/Xmpp/Fake_XMPP.php b/plugins/Xmpp/Fake_XMPP.php
index a0f329ca0..0f7cfd3b4 100644
--- a/plugins/Xmpp/Fake_XMPP.php
+++ b/plugins/Xmpp/Fake_XMPP.php
@@ -49,10 +49,20 @@ class Fake_XMPP extends XMPPHP_XMPP
 	 */
 	public function __construct($host, $port, $user, $password, $resource, $server = null, $printlog = false, $loglevel = null)
 	{
-		parent::__construct($host, $port, $user, $password, $resource, $server, $printlog, $loglevel);
-		// Normally the fulljid isn't filled out until resource binding time;
-		// we need to save it here since we're not talking to a real server.
-		$this->fulljid = "{$this->basejid}/{$this->resource}";
+        parent::__construct($host, $port, $user, $password, $resource, $server, $printlog, $loglevel);
+
+        // We use $host to connect, but $server to build JIDs if specified.
+        // This seems to fix an upstream bug where $host was used to build
+        // $this->basejid, never seen since it isn't actually used in the base
+        // classes.
+        if (!$server) {
+            $server = $this->host;
+        }
+        $this->basejid = $this->user . '@' . $server;
+
+        // Normally the fulljid is filled out by the server at resource binding
+        // time, but we need to do it since we're not talking to a real server.
+        $this->fulljid = "{$this->basejid}/{$this->resource}";
     }
 
     /**